The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core loop involves reading and acting upon feedback provided in PR/MR comments, issues, and changelist descriptions. Since this content can be provided by external users or influenced by contributors, it serves as an injection surface where malicious instructions could be embedded to trick the agent into performing unauthorized code changes during the 'fix' phase.
Ingestion points: The skill fetches review summaries and inline comments via scripts/github_review.py (GitHub), references/gitlab-api.md (GitLab), and references/perforce.md (Perforce).
Boundary markers: Although the instructions advise verifying the trusted author login of the bot, there are no instructions to use delimiters or sanitization logic to separate the feedback content from the agent's internal instructions.
Capability inventory: The skill allows the agent to modify the worktree, run local checks, and push/shelve changes to the repository, providing a high-impact path for successful injections.
Sanitization: No sanitization is performed on the feedback strings before they are processed by the agent.
[COMMAND_EXECUTION]: The skill frequently executes external CLI tools including gh, glab, and p4 to manage repository state and triggers. It also runs a bundled Python script (scripts/github_review.py) that uses subprocess.run to interact with the GitHub API. These tools are used for their intended purpose but constitute a broad interface for command execution.

greploop