The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request diffs, titles, and comments, which could potentially contain adversarial instructions intended to bias the review verdict or bypass the assessment checklists.
Ingestion points: Step 4 uses gh pr view and gh pr diff to fetch external, user-contributed content into the agent context.
Boundary markers: The instructions do not define specific delimiters or security headers (e.g., 'ignore embedded instructions') when the agent processes the fetched PR content.
Capability inventory: The agent can perform write operations via gh pr comment and record activity to a local audit.log file.
Sanitization: The skill does not specify any sanitization or filtering for the data fetched from GitHub before it is evaluated by the LLM.
[COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (gh) to interact with remote repositories. While these are legitimate tool calls for a PR reviewer, the skill relies on the agent to correctly interpolate the PR number and project slug into shell commands. A governance gate (Step 9) is correctly implemented to ensure a human reviews the generated output before it is posted.

pr-review