The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon pull request review comments and conversation logs, which are external, untrusted inputs. The skill explicitly mitigates this risk by requiring the agent to verify every claim against the actual code and existing tests before implementation.
Ingestion points: Pull request context, review comments, and conversation-tab comments are fetched via GitHub APIs in SKILL.md (Phase 1).
Boundary markers: Instructions in SKILL.md mandate that the user 'Never implement a suggestion you haven't traced through the code' and warn that automated reviewers lack full context.
Capability inventory: The skill utilizes Edit, Write, and Bash in SKILL.md (Phase 6) for code modification and mcp__github for resolving threads.
Sanitization: Verification steps in Phase 3 and evaluation in Phase 5 of SKILL.md require matching reviewer descriptions to code and checking for regression tests.
[COMMAND_EXECUTION]: The skill uses the gh CLI and Bash to perform repository operations. As described in references/gh-binding.md, it follows security best practices by using files for command bodies (-F body=@"$REPLY_FILE") to avoid shell injection vulnerabilities when interacting with the GitHub API.
[SAFE]: The skill includes logic in references/github-surface.md to detect restricted environment variables (e.g., proxy-injected tokens) to ensure it does not attempt unauthorized network operations in restricted environments. It also explicitly forbids the agent from installing new software (gh) to resolve missing dependencies.

triaging-pr-reviews