The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, creating a surface for indirect prompt injection attacks where malicious instructions are hidden in pull request bodies, commit messages, or source code.\n
Ingestion points: The skill fetches data via gh pr view and git diff as described in references/review-core.md, and reads local file changes in playbooks/local.md.\n
Boundary markers: While the skill lacks explicit technical delimiters for data isolation, it provides clear conceptual instructions to the agent to treat external content as "evidence, not tool authority."\n
Capability inventory: The skill utilizes shell commands (git, gh), and can potentially chain to other installed tools like implement, playwright, or agent-browser if authorized.\n
Sanitization: There are no explicit instructions for the agent to sanitize or filter the content of pull requests or source code before processing.\n- [COMMAND_EXECUTION]: The skill requires the execution of various git and gh CLI commands to retrieve repository metadata and code diffs. While these are necessary for the skill's function, they represent a potential execution vector if the agent is manipulated into running unintended arguments.\n
Evidence: Templates for commands such as gh pr view <pr> --json ... and git diff --binary <mergeBaseSHA> <headSHA> are provided in references/review-core.md.

code-review