The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process untrusted text from pull request comments, which creates a surface for indirect prompt injection. The implementation includes significant defensive measures as required by the analysis framework: \n * Ingestion points: Pull request comments, review bodies, and issue-level comments are fetched by scripts/pr_loop.py using the GitHub API via the gh CLI. \n * Boundary markers: The skill employs random per-run nonces to wrap untrusted content in <fence>...</fence> tags, ensuring that malicious content cannot break out of the data context to influence the agent. \n * Capability inventory: The tool is limited to GitHub API operations such as posting replies, adding reactions, and resolving threads. It does not have broader shell or file system access. \n * Sanitization: The script includes a proactive scanner (INJECTION_PATTERNS) that identifies and alerts the user to attempts at instruction overrides, role-play bypasses, and data exfiltration patterns within the comments.\n- [COMMAND_EXECUTION]: The helper script scripts/pr_loop.py invokes the gh CLI tool using subprocess.run. The implementation follows security best practices by passing arguments as a list and hardcoding the executable path as gh, which prevents shell injection vulnerabilities. This usage is benign and standard for interacting with external tools.

pr-review-loop