The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Pull Request descriptions, code diffs, and existing comments. This content could potentially contain malicious instructions intended to influence the agent's behavior during the review process.
Ingestion points: External data enters via the get_pull_detail, get_diff_files, and list_comments tools.
Boundary markers: The instructions do not define explicit delimiters to separate untrusted PR content from the agent's review instructions.
Capability inventory: The skill has the capability to write to the repository using the create_comment tool.
Sanitization: The risk is significantly mitigated by Step 6, which forces a 'STOP' and requires the user to manually verify and confirm the review content before the agent is allowed to post it.

review-pr