The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external contributors, specifically Pull Request descriptions and source code diffs. This creates a surface for indirect prompt injection where malicious instructions could be embedded in code comments or PR documentation to influence the agent's review logic.
Ingestion points: SKILL.md (Review Process Step 1) instructs the agent to read PR descriptions and full diffs; README.md describes loading all markdown files from the references/ directory.
Boundary markers: The instructions lack specific delimiters or explicit "ignore embedded instructions" directives to prevent the agent from accidentally following instructions found within the code it is reviewing.
Capability inventory: The skill utilizes the rg (ripgrep) command-line tool to search and navigate the file system across modules.
Sanitization: No input sanitization, escaping, or validation of the ingested PR content is described in the workflow.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md explicitly direct the agent to use the rg (ripgrep) command-line tool to trace code definitions, implementations, and call sites during the review process.

ai-review