The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data in the form of pull request diffs and file content. A malicious pull request could contain embedded instructions intended to manipulate the agent's review logic or verdict.
Ingestion points: The skill reads PR content using git diff, git fetch, and git show (e.g., in SKILL.md).
Boundary markers: While the instructions guide the agent on how to structure the report, they do not explicitly mandate delimiters for isolating untrusted code during the analysis phase.
Capability inventory: The agent can execute shell commands (git, gh, mise) and perform network write operations via the GitHub API (gh api).
Sanitization: The skill includes a mitigation strategy by instructing the use of a quoted heredoc (<<'REVIEW_JSON') when interacting with the gh api, which prevents shell expansion of the potentially tainted review body.
[COMMAND_EXECUTION]: The skill uses local shell commands including git, gh, and mise to interact with the repository and post review results. These operations are restricted to the vendor's repository and are required for the skill's stated purpose.

review-pr