The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources, specifically pull request comments and review threads. This input could potentially contain malicious instructions or jailbreak attempts designed to manipulate the agent into performing unauthorized code changes or data exfiltration.
Ingestion points: PR feedback is fetched from the forge (via gh api) or pasted by the user as described in SKILL.md Step 1.
Boundary markers: The instructions lack explicit delimitation or technical sanitization for the ingested feedback text.
Capability inventory: The skill possesses capabilities including source code modification, local script execution (prose-lint.py), and network/CLI interaction (gh, git).
Sanitization: No specific technical sanitization or escaping of feedback content is performed; the workflow relies on the agent's semantic cross-validation against repo code and design documents to filter out invalid or malicious suggestions.
[COMMAND_EXECUTION]: The skill executes local scripts and CLI tools to perform its tasks.
It runs a Python script located at <plugin root>/scripts/prose-lint.py to validate generated reports and replies.
It utilizes the GitHub CLI (gh api, gh pr comment) and git for repository interaction and feedback retrieval.
[DATA_EXFILTRATION]: The skill performs network operations through the GitHub CLI to fetch and post content to a git forge. While these operations target a well-known service (GitHub), the agent is instructed to fetch potentially attacker-controlled data (review comments) and post responses based on the analyzed content.

revise