The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by processing external data and executing commands based on that data.
Ingestion points: The skill fetches untrusted data via gh pr view (PR body/title) and multiple gh api calls to retrieve inline review comments, issue comments, and review threads in SKILL.md.
Boundary markers: There are no boundary markers or instructions to the agent to treat external comment content as untrusted. The instructions in Step 2: Triage Comments explicitly tell the agent to "assess" and "accept" suggestions from both humans and bots, which could include malicious instructions.
Capability inventory: The skill has extensive write capabilities, including the Bash tool for git checkout, git commit, git push, and gh pr edit, as well as Edit and Write tools for local file modification.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the fetched comment content before it influences the agent's logic for fixing code or responding to threads.

my-pr-checker