The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub Pull Requests, including titles, descriptions, and the entire review history. This external data is passed to the AI review engine, creating a surface for indirect prompt injection where a malicious PR could attempt to bypass review constraints or influence the agent's behavior.
Ingestion points: In scripts/pr-helper.sh, the subcommands init, history, and suppress use gh pr view and the GitHub GraphQL API to fetch external content.
Boundary markers: The skill employs unique UUID markers to track its own comments and reports, and the engine is configured to use adversarial review modes to detect and filter suspicious findings.
Capability inventory: The skill can read and write PR data on GitHub and perform local file operations within a dedicated .review-anvil directory.
Sanitization: Structured data is handled via jq and json.loads in Python. Finding metadata is parsed using specific regex patterns to prevent schema confusion attacks.
[COMMAND_EXECUTION]: The skill orchestrates its workflow by executing several shell utilities, including gh, git, jq, and uuidgen, as well as a local helper script.
Evidence: SKILL.md provides instructions for the agent to resolve and run scripts/pr-helper.sh for various tasks.
Security Controls: The skill enforces a strict resolution policy for its helper script, requiring it to reside in trusted installation roots and explicitly forbidding project-scoped paths to prevent execution of malicious scripts planted in a reviewed repository.
[DYNAMIC_EXECUTION]: The helper script utilizes embedded Python code for structured data processing.
Evidence: scripts/pr-helper.sh contains several Python scripts embedded as heredocs that are executed at runtime to parse PR history and filter findings.
Mitigation: These scripts are executed using uv run --no-project, which prevents the interpreter from loading potentially malicious local project configurations or dependencies from the worktree being reviewed.

review-anvil-pr