The Agent Skills Directory

Command Execution: The skill executes several shell commands and local scripts (e.g., ci-wait.sh, lint.sh, test.sh) located in the .claude/hooks/ directory. While this is standard for CI/CD automation, it assumes the local repository environment is trusted, as these scripts are executed with the agent's permissions.
Indirect Prompt Injection Surface: The skill ingests untrusted data from external sources, specifically CI failure logs and GitHub PR comments/reviews from the greptile-apps[bot].
Ingestion points: Data enters the context via gh run view --log-failed and gh api calls for review bodies and comments in SKILL.md.
Boundary markers: The skill does not use explicit delimiters or specific instructions to ignore embedded prompts within the ingested data.
Capability inventory: The agent has permissions for file modification (Edit, Write), command execution (Bash), and network interaction (git push, gh api replies).
Sanitization: The skill includes a logic check to compare suggested changes against PRINCIPLES.md and INVARIANTS.md, and it utilizes the AskUserQuestion tool to require human approval before committing review-based changes, which serves as a significant mitigation.
Automated Git Operations: The skill performs automated git commit and git push operations. The use of a human-approval checkpoint before these actions is a recommended practice to prevent unintended code changes.

watch-pr