The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands using gh (GitHub CLI) and git to retrieve repository data, metadata, and interact with the GitHub API. It includes instructions for handling ANSI color codes and safely encoding comment bodies for the API.
[DATA_EXFILTRATION]: The skill retrieves pull request diffs, issue content, and contributor history. While this is the intended purpose of the tool, it involves reading potentially sensitive code and metadata from the repository and can write results back to GitHub or local files.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted content from external sources (pull requests and issues) that the agent uses to inform its summaries and generate review comments.
Ingestion points: Pull request titles, descriptions, and linked issue content (titles, bodies, and comments) retrieved via gh pr view and gh issue view in SKILL.md.
Boundary markers: The instructions lack specific delimiters or warnings to treat external data as untrusted or to ignore embedded instructions within that data.
Capability inventory: The agent has the capability to write to the local filesystem (e.g., .pr-review/HISTORY.md or a user-provided --working-file) and post content to GitHub via gh api (SKILL.md).
Sanitization: The skill uses jq -Rs . to escape data for JSON API payloads, providing technical protection against command injection in the network request, but it does not sanitize the semantic content against malicious prompt instructions.

understand-pr