The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests, which creates a potential surface for indirect prompt injection attacks.
Ingestion points: Pull request metadata, diffs, and existing comments are fetched using gh pr view and gh api in SKILL.md.
Boundary markers: The skill includes a 'Security' section that explicitly warns the agent to treat PR content as untrusted and to ignore instructions embedded in code comments or PR descriptions.
Capability inventory: The agent can write to the pull request by posting batches of review comments using the gh CLI.
Sanitization: The skill uses jq to safely wrap the model-generated review content into a JSON payload, preventing potential command injection into the shell when calling the GitHub API.
[COMMAND_EXECUTION]: Both the skill and the helper script review-train.sh perform multiple system command executions.
Evidence: The skill uses gh, jq, and git. The helper script additionally uses pi and awk, and supports glow for output formatting.
Sanitization: Input validation is present; for example, the review-train.sh script checks that the PR ID is numeric and validates model names against a list of available models provided by the platform.
[EXTERNAL_DOWNLOADS]: The documentation describes how to obtain the skill and its scripts from external sources.
Evidence: scripts/README.md provides installation instructions via npx skills and git clone from github.com/lmammino/agent-review-skills.git. The script documentation explicitly advises against high-risk patterns like piped remote script execution.

adversarial-review