The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the GitHub (gh) CLI to perform all repository interactions, including searching for pull requests, fetching diffs, and submitting reviews. These operations are performed via execFile in dedicated scripts such as scripts/generate_review_batch.mjs and scripts/execute_decisions.mjs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, such as titles and bodies, which are ingested into the agent's context during batch generation. This creates a surface for indirect prompt injection where malicious PR content could influence the agent's summary or proposed actions. The skill requires human approval in a companion UI (AirApp) before any mutations are submitted to GitHub.
Ingestion points: scripts/generate_review_batch.mjs fetches PR titles, bodies, and diffs from GitHub.
Boundary markers: None identified in the prompt interpolation process.
Capability inventory: scripts/execute_decisions.mjs executes gh pr review commands.
Sanitization: PR content is truncated for length but not sanitized for instruction markers.
[EXTERNAL_DOWNLOADS]: The skill communicates with GitHub to fetch pull request data and with Busabase to store and retrieve the review queue. These operations target well-known and expected services for the skill's purpose.
[CREDENTIALS_UNSAFE]: The skill's scripts are designed to read configuration and secrets from environment variables and local files like .env and ~/.config/kelly-pr-review/config.json. These are used to manage authentication for Busabase and GitHub. No hardcoded credentials were found in the skill source code.

kelly-pr-review