The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from PR descriptions and commit messages to guide its code review and automated fix actions, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via PR descriptions, commit messages, and repository-specific configuration files such as AGENTS.md, CLAUDE.md, and REVIEW.md (as documented in SKILL.md step 2).
Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore embedded instructions' warnings when interpolating this untrusted text into the agent's reasoning process.
Capability inventory: The skill possesses significant capabilities, including the ability to write to files, execute shell commands (git, gh, grep), and run arbitrary repository-defined scripts (e.g., npm test, pytest) during its 'apply' mode.
Sanitization: There is no mention of sanitizing or escaping the untrusted external content before it is processed by the agent.
[COMMAND_EXECUTION]: In its 'Apply' mode, the skill is instructed to run the 'repository's documented lint, type, and test commands' without additional user confirmation (as documented in the 'Apply' section of SKILL.md).
Evidence: The skill executes local repository scripts which are defined in files like package.json or Makefile. If a malicious actor controls the repository being 'tidied', they could define these commands to perform unauthorized actions such as data exfiltration or system modification when the agent attempts to run tests or linting.

tidy