The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted GitHub PR comments and reviews, which creates an attack surface where an attacker could embed malicious instructions to influence the agent's behavior.
Ingestion points: The skill uses gh api and gh pr view to fetch PR comments and reviews in Phase 1 (SKILL.md).
Boundary markers: Explicit instructions in the 'Security' section direct the agent to treat PR content as data and ignore any instructions within it.
Capability inventory: The skill can modify the local filesystem via file writes and push changes to a remote repository via git push (Phase 2).
Sanitization: The workflow requires a human-in-the-loop 'Assess' phase where the user must approve or modify resolutions in a table before they are applied.
[COMMAND_EXECUTION]: The skill executes shell commands (gh, git) that incorporate a user-provided PR number or URL. If this input is not sanitized by the calling agent, it could lead to command injection.
Evidence: Use of the <number> placeholder in command blocks for gh pr view, gh pr checkout, and gh api throughout SKILL.md.

reconcile-review