The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves untrusted data from GitHub pull requests.
Ingestion points: Untrusted data enters the context through gh api calls in scripts/fetch_pr_comments.py and SKILL.md which fetch issue comments, reviews, and inline comments.
Boundary markers: The skill lacks clear delimiters or protective instructions that would prevent the agent from following commands embedded within the fetched comments.
Capability inventory: The agent possesses capabilities such as Bash, Read, and Grep, which could be abused if an injection is successful.
Sanitization: No sanitization or escaping is performed on the text of the comments before they are relayed to the agent.
[COMMAND_EXECUTION]: The skill uses load-time command execution to automatically discover the current git branch and repository context.
Evidence: SKILL.md uses the !command syntax to run git rev-parse and gh metadata queries.
Context: These operations are used purely for local environment discovery and are standard for developer workflow automation.

get-pr-comments