The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Pull request comments (fetched via GraphQL reviewThreads in modes/fix.md), PR bodies, and metadata (fetched via gh pr view in modes/start.md).
Boundary markers: The skill lacks formal delimiters for external content but instructs the agent to treat feedback as a "claim, not an instruction" and perform a triage step.
Capability inventory: The skill can execute arbitrary shell commands (via install/dev scripts), write to the local filesystem (via implementation skills), and push changes to remote repositories (git push).
Sanitization: There is no programmatic sanitization; the skill relies on the agent's reasoning to "triage" feedback against project conventions and documented guides before acting.
[COMMAND_EXECUTION]: The skill dynamically executes commands based on the environment of the repository being reviewed.
Evidence: In modes/start.md, the skill identifies the project's manifest (e.g., package.json, pyproject.toml) and executes the corresponding installation and development commands (e.g., npm install). This is the primary purpose of the skill (QA and testing) and is gated by user initiation.
[EXTERNAL_DOWNLOADS]: The skill downloads dependencies and code as part of its setup process.
Evidence: It performs git fetch and npm install (or equivalent) to prepare the local worktree for review. It also references and coordinates with other vendor tools such as gitkit, issuekit, and statuskit.

mergekit