The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data (GitHub PR and issue comments) to determine which code changes to implement. This creates a significant surface for indirect prompt injection attacks.
Ingestion points: External comments are fetched via the gh CLI and processed by scripts/extract-pr-comments.js as described in SKILL.md.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to treat comment content as untrusted data.
Capability inventory: The skill has the capability to write to the file system (to implement fixes), execute shell commands (to run tests), and commit changes to a Git repository.
Sanitization: The extract-pr-comments.js script filters for bot content and classification, but does not perform any sanitization or escaping of the comment body before it is presented to the agent as a TODO item.
[COMMAND_EXECUTION]: The skill utilizes the gh CLI to fetch pull request data and executes a local Node.js script (extract-pr-comments.js) to process the data. It also performs standard development tasks like running tests and executing git commit.

pr-review