The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It retrieves pull request review comments from GitHub using the gh CLI and the scripts/gh-review-comments utility. These comments are then processed by the agent to assess code validity and plan implementation changes. A malicious contributor could post comments containing adversarial instructions intended to subvert the agent's logic, potentially leading to unauthorized code modifications or tool misuse.
Ingestion points: The scripts/gh-review-comments script fetches review thread data from the GitHub GraphQL API.
Boundary markers: The provided instructions do not specify the use of delimiters or explicit warnings to the agent to ignore instructions embedded within the fetched comment bodies.
Capability inventory: The agent has extensive capabilities including code modification via git and remote repository interaction via gh.
Sanitization: There is no evidence of content sanitization or validation for the retrieved comment strings before they are incorporated into the agent's working context.
[COMMAND_EXECUTION]: The skill's instructions explicitly direct the agent to 'Escalate network permissions for gh when sandboxing blocks GitHub API calls' and to 'retry with escalated permissions' on failure. While this is likely intended to ensure the agent has the necessary network access to interact with GitHub, it represents a pattern of requesting the agent to actively pursue bypasses of initial security and sandbox constraints.

pull-request