The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of Pull Request diffs and metadata, which creates a potential surface for indirect prompt injection.
Ingestion points: The skill uses gh pr view and gh pr diff in SKILL.md to fetch external content into the agent's context.
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the fetched diff content, which could allow adversarial code comments to influence the agent's behavior.
Capability inventory: The skill has access to the Bash and Write tools, which are used to execute gh commands and post comments. An injection could theoretically attempt to manipulate these tool calls.
Sanitization: No explicit sanitization or filtering of the PR content is described in the skill's logic.
Assessment: This vulnerability surface is inherent to the skill's primary purpose of reviewing external code. No malicious exploitation is present in the skill's own code.

canon-pr-review