The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands that interpolate user-provided strings from $ARGUMENTS, which could lead to command injection if input is not validated by the agent.\n
Evidence: Placeholders like <number>, <owner>, <repo>, and <paths> are used directly in commands such as gh pr view <number> and git diff HEAD -- <paths>.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and metadata from GitHub pull requests or local files to provide analysis.\n
Ingestion points: mcp__github__pull_request_read, gh pr diff, git diff, and the Read tool are used to fetch external code content.\n
Boundary markers: Absent. The instructions do not specify the use of delimiters (e.g., XML tags or code blocks) to isolate untrusted code from instructions for the specialized agents.\n
Capability inventory: The skill environment has access to shell execution (gh, git, go install), file system operations (mkdir, Read), and multi-agent coordination (TeamCreate, SendMessage).\n
Sanitization: Absent. Untrusted code is analyzed directly without filtering or escaping.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests downloading an external tool and agents are instructed to fetch remote documentation at runtime.\n
Evidence: go install github.com/github/github-mcp-server/cmd/github-mcp-server@latest and reference to https://go.dev/doc/effective_go.\n
Note: These sources are well-known or trusted, posing minimal inherent risk.

code-review