The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull request comments and review threads which may contain malicious instructions designed to hijack the agent's behavior.
Ingestion points: Pull request comments, review bodies, and discussion threads are fetched by scripts/fetch_review_context.py using GraphQL queries.
Boundary markers: The skill lacks explicit delimiters or instructions to the agent to treat the fetched PR content strictly as data, increasing the risk of the agent "obeying" instructions found within comments.
Capability inventory: The agent is authorized to modify source code, create commits, and push changes to the remote repository (git push). It also has the ability to reply to PR threads and resolve them.
Sanitization: There is no evidence of sanitization or filtering of the fetched content before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill executes external commands via the GitHub CLI (gh) to interact with the repository and fetch data.
Evidence: subprocess.run calls in scripts/fetch_review_context.py execute gh auth status, gh repo view, gh pr view, and gh api graphql. While these are implemented using argument lists (avoiding shell=True), they provide the agent with a powerful interface to the GitHub platform.

pr-comments-audit