The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from git diffs and pull request content, which serves as a potential indirect prompt injection surface. This is a common property of automated review tools.
Ingestion points: The skill reads output from git diff and gh pr diff in context/self.md, context/per-slice.md, and context/pr.md.
Boundary markers: Instructions use markdown headers for structure but lack explicit boundary delimiters or warnings to ignore embedded instructions in the ingested data.
Capability inventory: The skill can execute shell commands (git, gh) and dispatch other agents (code-reviewer, security-reviewer, etc.).
Sanitization: There is no evidence of sanitization, filtering, or escaping of the external content before it is processed by the AI agents.
[COMMAND_EXECUTION]: The skill uses dynamic context injection to pre-compute repository information at load time.
Evidence: The skill executes git branch, git status, and gh pr list in SKILL.md via the dynamic execution syntax.
Analysis: These commands are used for legitimate discovery of project state and are consistent with the allowed-tools configuration.

quality-gate