The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of pull request diffs and bodies authored by others. This creates a surface where malicious instructions embedded in a pull request could attempt to influence the agent's review or summary.
Ingestion points: Processes pull request diffs and content retrieved via git show and /code-review triggers.
Boundary markers: The instructions do not mandate the use of delimiters or 'ignore' markers when the agent processes the untrusted PR content.
Capability inventory: The skill uses gh api to write comments back to GitHub repositories and executes local commands like git and mise.
Sanitization: While explicit sanitization of the PR content is not mentioned, the skill uses quoted heredocs (<<'REVIEW_JSON') when assembling the API payload, which is a robust defense against shell command injection.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands to facilitate the review process, including git fetch, git show, gh api, and mise run lint.
The use of gh api allows the agent to create public comments on GitHub repositories.
The skill mitigates risks in manual mode by requiring explicit user confirmation before posting ('Do not post without an explicit yes').
In automated/CI mode, the skill increases autonomy by posting without asking, though it limits the number of findings to reduce noise.

review-pr