The Agent Skills Directory

[PROMPT_INJECTION]: Indirect prompt injection surface identified. The skill is designed to fetch and analyze untrusted data (PR content, diffs, and comments) from external sources, which could contain adversarial instructions. \n- Ingestion points: The skill uses gh pr view, gh pr diff, and git diff as described in SKILL.md (Wave 0) to bring external code changes into the agent's context. \n- Boundary markers: The instructions lack explicit boundary markers (e.g., XML tags or delimiters) or specific warnings to ignore instructions embedded within the ingested code. \n- Capability inventory: The agent has the capability to run repository-specific tests via uv run python -m pytest, search for code patterns with rg and sed, and interact with the GitHub API via gh. \n- Sanitization: There is no evidence of sanitization or filtering of the ingested content to prevent instructions in code comments from being interpreted as commands by the LLM.

review-pr