The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Process.run interface in the github_cli.dart library to execute git, gh (GitHub CLI), and dart commands. These tools are used to inspect the repository state, fetch pull request metadata, retrieve CI/CD logs, and perform static analysis. The command arguments are passed as a list, which effectively prevents shell injection vulnerabilities.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests untrusted data from GitHub Pull Request comments and CI/CD status logs.
Ingestion points: The triage.dart script fetches PR review threads and CI status logs using the GitHub GraphQL API and the gh command-line tool.
Boundary markers: The SKILL.md instructions include a 'Critical Mindset' section that explicitly warns the agent that bot-generated severity badges and reviewer feedback are unverified external claims that must not be trusted blindly.
Capability inventory: The agent possesses the capability to modify code, perform Git operations (add, commit, push), and interact with the GitHub API to post replies and resolve threads.
Sanitization: The skill implements a 'Mandatory Pre-Edit Empirical Verification Gate', requiring the agent to run dart analyze on the original codebase to verify the validity of reviewer claims before implementation. Furthermore, the skill enforces a hard gate requiring explicit user approval of the triage plan before any code edits or VCS operations are performed.

github-pr-triage