The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted external data and uses it to modify the agent's instruction layer. Specifically, it reads pull request comments and commit messages to generate new rules for .agents/rules/ and AGENTS.md, which are auto-injected into every agent turn.
Ingestion points: External data is ingested from pull request review threads and commit messages via the gh api in SKILL.md.
Boundary markers: No specific boundary markers or delimiters are defined to separate untrusted data from the rest of the prompt during processing.
Capability inventory: The skill has high-impact write capabilities, allowing it to propose and apply changes to files that dictate the agent's behavior and system knowledge.
Sanitization: There is no explicit requirement for the agent to sanitize or filter the extracted content before promoting it to a durable instruction.
[COMMAND_EXECUTION]: The skill uses shell commands like gh pr view, gh api, and grep which incorporate user-provided arguments ($ARGUMENTS) or content derived from external PR comments (keywords). If these inputs are not strictly validated or escaped, they could potentially lead to command injection within the local shell environment.

harvesting-review