The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, including code diffs, issue descriptions, and user comments. This represents a potential surface for indirect prompt injection where malicious instructions could be embedded in the PR data.
Ingestion points: The skill uses gh pr diff and git show to read PR content and metadata from the repository.
Boundary markers: The skill explicitly instructs the agent to "Treat PR code as untrusted" and "Inspect changed install, build, test, and automation scripts before executing them."
Capability inventory: The agent has access to git, gh CLI, and repository-specific just commands which execute shell tasks via a local justfile.
Sanitization: The skill relies on agent-led inspection and human confirmation rather than automated sanitization.
[COMMAND_EXECUTION]: The skill utilizes several command-line tools to perform its review, including git, gh (GitHub CLI), and just (a command runner).
Evidence: Instructions in SKILL.md and references/rolldown-repo.md direct the agent to run commands such as gh pr diff, just build, just test-rust, and gh api for posting reviews. These are consistent with the skill's primary purpose of automated PR review and validation.
[EXTERNAL_DOWNLOADS]: The project's build and setup processes involve downloading external dependencies via standard package managers.
Evidence: The just setup and just build commands listed in references/rolldown-repo.md invoke cargo, pnpm, and cmake to install and build software components. These operations target official registries like crates.io and npmjs.org.

hyfdev-rolldown-pr-review