The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes untrusted code and diffs from pull requests to identify "important parts" and assist in human-led reviews.
Ingestion points: Pull request content and file structures are read using the Read tool and git commands as specified in Step 6.
Boundary markers: The instructions do not define specific boundary markers or "ignore instructions" delimiters when the agent reads PR file content.
Capability inventory: The agent has access to git, az, and gh commands, and can post comments via the ado MCP tool or official REST APIs.
Sanitization: The instructions proactively mandate using a JSON serializer for API request bodies rather than string interpolation to prevent injection vulnerabilities in API calls.
Consideration: Malicious pull requests could theoretically contain instructions intended to influence the AI's summarization. This is addressed by the requirement for explicit human approval before any comment is posted back to the platform.
Command Execution via Platform Tooling: The skill utilizes git, az (Azure CLI), and gh (GitHub CLI) to manage worktrees and interact with pull request metadata.
Pull request identifiers (IDs, branches, and commit OIDs) parsed from user-provided URLs are passed as arguments to these tools. The skill provides clear instructions for parsing these fields correctly to ensure operational reliability.
Management of Official Extensions: The skill ensures the environment is prepared by checking for and installing the azure-devops extension for the Azure CLI if it is missing.
Source: The extension is fetched via official channels using az extension add.
Context: This is a routine setup operation for interacting with Azure DevOps services using official vendor tooling.

review-pr-local