The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests (titles, bodies, and code diffs). * Ingestion points: Untrusted data enters the agent context via scripts/get_pr.sh, scripts/get_pr_diff.sh, and scripts/get_comments.sh. * Boundary markers: The instructions in SKILL.md explicitly command the agent to ignore any instructions found in the PR content. * Capability inventory: The skill has read access to repository files and the ability to write a review-decision.json file that triggers automated labels, comments, or PR closures. * Sanitization: Instructions mandate that the agent must paraphrase summaries and avoid echoing attacker-controlled text verbatim.

reviewing-prs