The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git and gh (GitHub CLI) commands in Step 1 to retrieve PR metadata, branch information, and code diffs. This is standard functionality for a code review tool, but it involves executing shell commands with arguments derived from potentially untrusted PR numbers.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input that could contain malicious instructions designed to subvert the review process.
Ingestion points: The agent reads PR titles, bodies, and code diffs via gh pr view and gh pr diff. It also reads local files like CLAUDE.md and REVIEW.md which could be modified in a malicious PR.
Boundary markers: There are no explicit instructions or delimiters defined to separate the untrusted PR data from the agent's core instructions.
Capability inventory: The skill possesses read-only capabilities via git, gh, and filesystem reads. It explicitly instructs the agent NOT to post comments or approve PRs unless requested, which limits the potential impact of an injection.
Sanitization: The instructions do not define any sanitization or filtering logic for the content of the diffs or metadata being analyzed.

pr-review