The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It reads untrusted code directly from a GitHub Pull Request using git show and the Read tool to identify shortcomings. A malicious contributor could embed instructions within the PR code or comments to manipulate the agent's review summary or trigger unauthorized actions.
Ingestion points: git show <first-sha>:<path>, Read tool.
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore instructions found within the PR content.
Capability inventory: The skill can execute gh api calls and gh pr review commands, which can be used to comment, approve, or request changes on GitHub.
Sanitization: Absent. There is no mention of filtering or sanitizing the content read from the repository.
[COMMAND_EXECUTION]: The skill uses $ARGUMENTS provided by the user to construct shell-based commands for the GitHub CLI (e.g., gh api repos/<o>/<r>/pulls/<n>/commits). If the agent platform does not properly sanitize these arguments before execution, it could lead to local command injection.

review-summary