The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instruction in Step 7 directs the agent to 'retry with escalated permissions' if a GitHub API call fails due to network restrictions. This explicitly encourages the agent to bypass security constraints or acquire higher privilege levels than those initially granted.
[COMMAND_EXECUTION]: The skill instructs the agent to 'prefer a small shell helper function' for batching API calls. This involves the dynamic generation and execution of shell code at runtime to interact with the GitHub CLI.
[INDIRECT_PROMPT_INJECTION]: The skill performs extensive reading of external, attacker-controlled data, including PR diffs and existing review thread comments ('reviewThreads', 'comments', 'body'). There are no boundary markers or explicit sanitization instructions to prevent the agent from obeying instructions embedded in this untrusted data.
Ingestion points: Uses gh api graphql to fetch PR review threads and gh pr view for metadata.
Boundary markers: Absent. The instructions do not specify how to distinguish between legitimate code/comments and embedded malicious commands.
Capability inventory: Access to gh api, GraphQL mutations, shell execution via helper functions, and file system read access for inspecting changes.
Sanitization: None detected. The agent is encouraged to 'Read enough surrounding code' and 'trace the full flow', increasing the surface area for processing potentially malicious payloads.

gh-pr-review