The Agent Skills Directory

Indirect Prompt Injection: The skill ingests untrusted data from GitHub pull requests, including titles, bodies, and comments. This data is used to inform the expert panel's review, which presents a surface where malicious instructions embedded in a PR could attempt to influence the agent's behavior or output.
Ingestion points: Data enters the context via gh pr view and pagination of comments and linked issues (SKILL.md, Step 1).
Boundary markers: Untrusted bodies are truncated to 65,536 characters (Step 1). Data is passed to sub-agents in a structured "shared brief" packet (< 8 KB).
Capability inventory: The orchestrator can execute gh pr edit for reviewer requests and uses autopilot-comment for posting recommendations. It also spawns sub-tasks via the task tool.
Sanitization: The architecture uses a "sole writer" pattern where only the orchestrator performs writes. Specialist sub-agents are strictly forbidden from executing gh commands and must return structured JSON that is validated against predefined schemas (panelist-return-schema.json) before being rendered into a template.
Command Execution: The skill uses terminal tools to interact with the GitHub CLI and manage parallel execution of expert personas.
Evidence: The orchestrator executes commands like gh pr view, gh pr edit --add-reviewer, and utilizes the task tool for fan-out processing.
Context: These operations are standard and necessary for the skill's purpose of automating pull request reviews. The instructions explicitly centralize these capabilities to the orchestrator to prevent unauthorized actions by sub-agents.

autopilot-pr-review-worker