The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes content from pull request comments, review bodies, and issue trackers. This content is untrusted and could contain malicious instructions designed to influence the orchestrator or its subagents.
Ingestion points: Untrusted PR comments, review bodies, and external tickets are read in SKILL.md (Steps 1 and 2).
Boundary markers: The FIX-BRIEF.md template uses blockquote markers to delimit items but explicitly passes them "verbatim" to subagents, which may allow instructions within those comments to escape the intended context.
Capability inventory: The skill performs git operations (merge, checkout, push), file system writes via subagents, and executes arbitrary shell commands for testing and linting.
Sanitization: A mandatory developer approval step in Step 3 of SKILL.md serves as a critical human-in-the-loop check before any code is modified or pushed, mitigating but not eliminating the risk.
[COMMAND_EXECUTION]: The skill executes various shell commands, including git operations and grep. It relies on an external configuration file (docs/agents/pull-requests.md) to define the specific commands used for PR interactions, which could be manipulated to execute unintended actions.
[DYNAMIC_EXECUTION]: The skill executes the "repo's own commands" for typechecking and testing (Step 5). While standard for development workflows, this provides a mechanism for executing arbitrary scripts or binaries defined within the repository being processed.

resolving-pr-comments