The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from pull-request diffs and comments, creating a potential surface for indirect prompt injection. However, it implements comprehensive mitigations including:
Ingestion points: Pull-request metadata and diffs are fetched via GitHub APIs into isolated temporary files (diff.patch, files.jsonl).
Boundary markers: The system prompts and sub-agent instructions (e.g., in claude-review.yml) explicitly frame pull-request content as untrusted data that must not influence the agent's instructions or verdict.
Capability inventory: The environment restricts the agent to a 'review-only' toolset, explicitly denying Bash, Workflow, and administrative GitHub operations. Write capabilities are confined to posting formal reviews via a scoped GitHub App token.
Sanitization: All findings must be verified by a separate finding-validator sub-agent before being posted, reducing the risk of malicious input steering the final output.
[PRIVILEGE_ESCALATION]: The workflow template in claude-review.yml utilizes sudo commands to install bubblewrap and configure kernel parameters (kernel.apparmor_restrict_unprivileged_userns=0). These actions are performed to establish a secure subprocess isolation environment for the agent, adhering to hardening best practices for running LLM-steered processes in CI runners.
[EXTERNAL_DOWNLOADS]: The skill fetches tools and configurations from well-known and trusted sources:
Downloads and executes the anthropics/claude-code-action GitHub Action (Anthropic is a trusted vendor).
Pulls the github-mcp-server Docker image from ghcr.io/github (GitHub is a well-known service).
Clones the repository's own default branch to establish a 'trusted rules' directory, ensuring pull-requests cannot modify the rules governing their own review.
[COMMAND_EXECUTION]: The skill uses Node.js scripts (claude-review-gate.mjs and check-workflow-policy.mjs) to orchestrate the review process and enforce security boundaries. These scripts perform file I/O and data processing without utilizing dangerous dynamic execution patterns like eval() or unvalidated exec() calls on external input.
[CREDENTIALS_SAFE]: The skill uses standard GitHub repository secrets (CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY) for authentication. It includes a specific security script (check-workflow-policy.mjs) designed to ensure these secrets are only accessible to the authorized review step and cannot be exfiltrated via other workflow jobs.

claude-pr-review