The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from external sources to drive its logic.
Ingestion points: Data is ingested via gh pr view (title, body), gh pr diff (code changes), and mcp__linear-server__get_issue (ticket content).
Boundary markers: The instructions do not define explicit boundary markers (like XML tags or delimiters) to separate untrusted PR data from system instructions.
Capability inventory: The agent has the capability to write back to the environment using gh api to post comments, gh pr review --approve to approve changes, and gh api -X PATCH to modify PR descriptions.
Sanitization: The skill mitigates risks by requiring 'Adversarial verification' (Phase 3) where the agent must re-read code to confirm findings and filtering 'AI-slop' (Phase 6). It also uses file-based inputs for gh api (-F body=@file) which reduces shell injection risks in the comment body.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using gh and git CLIs to manage the PR review workflow.
Evidence: Commands include git fetch origin <branch>, gh pr view, gh pr diff, and gh api.
Context: These operations are core to the skill's purpose as a PR reviewer and are generally performed on local working trees or via authenticated API calls to the project's repository host.

switchyard-pr-reviewer