The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's behavior aligns with its documented purpose.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub Pull Request titles, bodies, and code diffs.
Ingestion points: PR context is fetched in SKILL.md (Phase 1) using gh pr view and gh pr diff.
Boundary markers: Absent.
Capability inventory: The skill can post review comments via gh api (Phase 4) and write configuration files to the .github/ directory using the Write tool.
Sanitization: The risk is mitigated by explicit user approval requirements in Phase 3 of the review mode and Phase 1 of the delegate mode. The agent is instructed never to post or create tasks without human confirmation.
[COMMAND_EXECUTION]: The skill executes gh and git commands via the Bash tool to perform repository operations. These commands are necessary for the skill's functionality and are scoped to the project environment.

copilot