The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from GitHub PR comments to guide its analysis and decision-making.
Ingestion points: Pull request review comments and summaries fetched via gh api graphql as described in the Workflow section of SKILL.md.
Boundary markers: Absent. The instructions do not specify the use of delimiters or specific warnings to the model to ignore instructions embedded within the fetched comments.
Capability inventory: The skill has the ability to read local files at arbitrary paths/lines provided in the PR metadata and can potentially hand off tasks to other skills like /tdd.
Sanitization: Absent. There is no requirement mentioned to escape, validate, or filter the content of the comments before they are processed by the agent.
[COMMAND_EXECUTION]: The skill executes gh (GitHub CLI) commands such as gh api graphql, gh pr view, and gh auth status. These commands are used to interact with a well-known service (GitHub) to perform the skill's core functions and do not involve downloading or executing untrusted scripts.

triage-review