The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted text from pull request comments (including human and bot-generated content). It implements robust safety protocols: it treats every comment as untrusted, explicitly forbids following instructions or URLs within comments, and isolates AI-targeted prompts into a separate 'reviewer_prompt' field to prevent them from influencing the agent's core instructions.
[COMMAND_EXECUTION]: The skill uses shell commands (gh, git, jq, python3) to interact with the repository and GitHub API. The instructions explicitly prohibit passing untrusted comment text into shell arguments. Instead, data is stored in files and processed via jq or python3 to mitigate command injection risks.
[DATA_EXFILTRATION]: The skill reads pull request data and repository files. It includes a sanitation step to strip credentials, secrets, and sensitive file paths from any output shown to the user or posted back to GitHub. Network operations are restricted to authenticated GitHub API calls using the gh tool.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads review threads, summary bodies, and PR comments via GitHub API (SKILL.md, references/collect.md).
Boundary markers: Implements strict "One rule that outranks the rest" treating all fetched text as untrusted. Separates bot-specific prompts from actionable instructions.
Capability inventory: Subprocess calls for git, gh, jq, and python3; file system write access for scratch directory; file system read for repository code (SKILL.md).
Sanitization: Explicit sanitization step in references/triage.md to strip secrets, shell commands, and external URLs before display or submission.

pr-autofix