The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow involves constructing and executing gh CLI commands. Specifically, it instructions the agent to use GH_HOST=<host> where the host is derived from user input or repository metadata. This presents a surface for command injection if the input is not strictly validated or escaped by the underlying platform before shell execution. Similar risks exist for the owner, repo, and number variables used in API paths.
[INDIRECT_PROMPT_INJECTION]: The skill acts on data ingested from external sources, including Pull Request diffs, existing comment threads, and candidate findings. A malicious contributor could attempt to embed instructions within these sources to influence the agent's review behavior or output.
Ingestion points: PR files fetched via repos/{owner}/{repo}/pulls/{number}/files and existing comments/reviews fetched via the pull requests API.
Boundary markers: The instructions lack explicit structural delimiters (like XML tags or specific block quotes) to isolate untrusted data during processing, though Step 3 and 4 instruct the agent to treat this data only as "candidate evidence" to be independently validated.
Capability inventory: The skill has the capability to write to the local filesystem (Step 7) and perform network mutations via the gh api POST method to create PR reviews.
Sanitization: A critical mitigation is present in Step 6 ("Preview and Approve"), which mandates that the agent must present an "approval packet" to the user and receive explicit authorization before any mutation (posting a review) occurs.

pr-review-comment