The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from GitHub pull request comments and review bodies to guide its actions.
Ingestion points: In SKILL.md (Phase 1), the agent is instructed to fetch pull request comments and reviews using the gh api tool.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the fetched content as untrusted or to ignore any instructions embedded within the comments.
Capability inventory: In SKILL.md, the agent is granted Write, Edit, and Bash capabilities to modify the codebase and execute scripts based on the triage of these untrusted comments.
Sanitization: There is no evidence of filtering or validation of the fetched comment content before the agent interprets it to perform code modifications.
[COMMAND_EXECUTION]: The skill instructions use shell command templates that incorporate user-provided parameters, creating a potential command or argument injection surface.
Evidence: In SKILL.md, placeholders like <pr-number> and <comment-id> are used in commands such as gh pr checks <pr-number> and ./scripts/post-reply.sh --pr <pr-number>. While the agent's tool access is restricted by a whitelist of allowed commands (gh, git, and a local script), unvalidated input could still be used to manipulate command arguments or execute unintended operations within the allowed tool set.

respond