The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from GitHub pull requests, including titles, descriptions, and file diffs. This information is passed to sub-agents to perform a security and correctness review. A malicious contributor could embed prompt injection instructions within a PR to manipulate the agent's output, potentially causing it to generate misleading comments or omit critical security findings.
Ingestion points: Fetches PR metadata (title, body) and file contents via gh pr view and gh pr diff as described in Step 1 and 2 of SKILL.md.
Boundary markers: Absent. The sub-agent briefs in Step 3 do not specify delimiters or warnings to ignore instructions embedded in the PR data.
Capability inventory: The skill has the ability to read arbitrary files within the target repository and post comments back to GitHub via scripts/gh_review.py.
Sanitization: No sanitization is performed on the PR content before it is processed by the LLM sub-agents.
[COMMAND_EXECUTION]: The skill executes external CLI tools (gh and git) through a Python helper script and direct instructions in SKILL.md. While scripts/gh_review.py uses subprocess.run with a list of arguments to avoid shell injection, it still passes user-provided or PR-derived strings (like repository names) to these tools. This could allow for argument injection if malicious strings are provided as repository or PR identifiers.

github-review