The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is instructed to read and process data from external sources (GitHub PR comments, reviews, and inline threads) to identify and fix code findings.
Ingestion points: External text content is retrieved from GitHub PRs using the gh tool as described in the 'Review loop'.
Boundary markers: There are no specified boundary markers or specialized instructions to prevent the agent from treating instructions embedded within PR comments as its own goal.
Capability inventory: The agent has the capability to write to the local filesystem (to address findings), execute project validation scripts, and push changes to remote repositories using gh pr comment and gh ... push.
Sanitization: The skill lacks logic to sanitize or filter the content of the reviews before the agent 'addresses' the findings, relying solely on the LLM to 'verify' validity.
[COMMAND_EXECUTION]: The skill makes extensive use of the gh (GitHub CLI) for repository operations, including making comments, polling checks, and pushing updates with history rewriting (--force-with-lease). While these are intended features, they provide a powerful mechanism that could be abused if the agent is influenced by malicious PR content.

finish-pr