The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git and GitHub CLI commands necessary for code analysis.
Evidence: SKILL.md describes executing commands like git diff, git log, git show, gh pr view, and gh pr diff to retrieve the code changes to be reviewed.
Control: Input parameters such as git references are validated using git rev-parse before use, and the tools are restricted to the repository context.
[EXTERNAL_DOWNLOADS]: The skill fetches data from external sources to perform its review tasks.
Evidence: Pull request details and diffs are downloaded from GitHub using the gh tool.
Note: GitHub is a trusted service, and these network operations are core to the skill's function of reviewing pull requests.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from code repositories and pull requests, which could contain malicious instructions.
Ingestion points: Untrusted data enters the agent context via code diffs retrieved by git diff and gh pr diff.
Boundary markers: The skill implements strong boundary markers. references/VALIDATOR.md includes a dedicated "Security boundary" section that explicitly instructs the validator subagent to treat all input data (diffs and items) as evidence, not instructions, and to ignore any embedded directives.
Capability inventory: The skill uses Bash, Read, Glob, Grep, and Task (for subagents). The system is designed to use read-only subagents for processing untrusted diffs to minimize risk.
Sanitization: The skill relies on clear instructions to isolate untrusted data from the agent's control logic.

aif-review