The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request descriptions and comments to generate visualization nodes and tour steps, creating an attack surface for indirect prompt injection.
Ingestion points: External data is retrieved using gh pr view and the GitHub API (gh api) in SKILL.md.
Boundary markers: The instructions do not specify explicit delimiters (such as XML tags or unique markers) to isolate untrusted PR content from the agent's internal reasoning context during the graph generation process.
Capability inventory: The skill has the capability to write files to the local .warp/ directory and execute shell commands (git, gh, npx wrangler).
Sanitization: The skill mitigates risks in the generated artifact by using a dedicated escapeHtml utility in scripts/d3_canvas_runtime.py to sanitize all user-controlled text before rendering it in the HTML detail panels.
[EXTERNAL_DOWNLOADS]: The skill downloads the D3 visualization library from a pinned, official release on JSDelivr's CDN. This is a well-known service and the use of a specific version (7.9.0) follows security best practices.
[COMMAND_EXECUTION]: The skill utilizes standard developer tools, including the GitHub CLI (gh), git, and Cloudflare's wrangler for repository analysis and optional site deployment. These operations are within the expected scope of a PR analysis tool and target well-known, reputable services.

pr-walkthrough