The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from pull request bodies, plan files, and branch diffs, which are evaluated by subagents to form a recommendation.
Ingestion points: The skill reads PR data via gh pr view and gh pr diff, and consumes arbitrary text or plan files provided in the $ARGUMENTS variable (SKILL.md, Phase 1).
Boundary markers: There are no explicit delimiters used to isolate untrusted PR/plan content from the subagent instructions. However, the 'Investigator' subagent is explicitly tasked with fact-checking all claims made by the 'artifact' (the untrusted input).
Capability inventory: The subagents are restricted to a read-only contract, prohibiting them from modifying the repository. The main agent has the ability to post a comment to GitHub via gh pr comment (SKILL.md, Phase 4) and transition to other tools.
Sanitization: The instructions do not specify any sanitization or escaping mechanisms for the untrusted data before it is presented to the subagents.
[COMMAND_EXECUTION]: The skill uses several command-line utilities to perform its analysis.
Tool usage: Employs gh pr view, gh pr diff, gh search code, and git log to gather context about the repository and the proposed changes.
User confirmation: The gh pr comment command, which writes to an external service, is explicitly gated by a requirement for the user to provide an 'explicit yes' before execution.

debate