The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions in SKILL.md explicitly direct the agent to bypass security sandboxing by requesting sandbox_permissions=require_escalated and "elevated network access" for GitHub CLI commands. This is an attempt to acquire higher privileges than the platform's default restricted environment provides.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from GitHub PR comments and reviews, creating a significant attack surface where a malicious user could influence the agent's behavior.
Ingestion points: The scripts/fetch_comments.py script fetches PR comments, review bodies, and thread content via the GitHub GraphQL API.
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are used when presenting fetched comments to the agent; the agent is directly instructed to "Apply fixes" based on this external content.
Capability inventory: The agent is tasked with modifying code and applying fixes, which involves broad filesystem access and potentially arbitrary command execution beyond the provided script.
Sanitization: There is no sanitization or validation of the content retrieved from GitHub before it is processed by the agent.
[COMMAND_EXECUTION]: The script scripts/fetch_comments.py uses the subprocess module to execute shell commands (gh pr view, gh api graphql). While the script's commands are structured, the overall skill workflow relies on the agent's ability to execute shell commands to apply code changes requested in comments.

gh-address-comments