The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using bash to interact with git and official command-line interfaces (gh for GitHub, glab for GitLab). These operations include fetching PR metadata, checking out branches, and viewing diffs. The implementation includes a validation step to ensure the local repository matches the PR URL provided by the user.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from external sources (PR titles, descriptions, and diffs) and passes this content into the prompts of subsequent verification agents.
Ingestion points: The PR metadata fetched in section 4 (title, body) and the diff content fetched in section 6 of SKILL.md.
Boundary markers: The skill uses a 'VERIFICATION SCOPE' template to define the context for sub-agents, but it does not implement explicit sanitization or instructions to disregard malicious directives hidden within the PR data.
Capability inventory: The skill has the ability to execute shell commands and invoke other automated skills (reviewer, tester), which could be targeted by instructions embedded in a malicious PR.
Sanitization: There is no evidence of filtering or sanitization performed on the content fetched from the remote PR before it is processed by the AI agents.

review-pr