The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external, untrusted content such as pull request diffs, metadata, and comments using tools like gh pr diff and gh pr view. This creates an attack surface where a malicious actor could embed instructions within code comments or commit messages designed to influence the agent's behavior (e.g., instructing it to approve a PR regardless of bugs).
Ingestion Points: Data enters the context via gh pr view, gh pr diff, gh api, and local file reads in SKILL.md.
Boundary Markers: There are no explicit delimiters or instructions provided to the agent to treat content within diffs as untrusted data or to ignore embedded natural language instructions.
Capability Inventory: The agent has the ability to execute shell commands (git, gh) and post content back to the GitHub API, which could be abused if an injection is successful.
Sanitization: No sanitization or validation of the ingested diff content is specified.
Command Execution: The skill relies on shell commands (git and gh) to interact with the local repository and the GitHub API. While these are used for the skill's primary purpose of code review, they represent a capability that requires careful monitoring when processing untrusted input.

code-review