The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub Pull Request titles and bodies, which could potentially contain malicious instructions intended to mislead the review process.
Ingestion points: Metadata and PR descriptions are retrieved via gh pr view in SKILL.md.
Boundary markers: There are no explicit delimiters or safety instructions provided to isolate the external PR content from the agent's primary instructions.
Capability inventory: The skill allows execution of gh CLI commands and reading of local project files across the repository.
Sanitization: No explicit sanitization is mentioned; however, the skill strongly instructs the agent to verify all claims in the PR description against the actual code diff and surrounding source files.
[COMMAND_EXECUTION]: The skill invokes the GitHub CLI (gh) to view PR details and diffs. These operations are restricted to read-only metadata and code retrieval from a well-known service, which is essential for the skill's stated purpose.
[DATA_EXPOSURE]: The skill instructions involve checking application-specific data directories such as ~/.kimi/ and ~/.kimi-code/ to ensure session data and migration compatibility. This access is scoped to the application's own configuration and state files.

review-pr