The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request review threads and possesses the capability to perform code modifications and commits.
Ingestion points: External comments within pull request review threads are analyzed to decide on code changes (referenced in SKILL.md logic).
Boundary markers: The instructions do not define specific delimiters or boundary markers to isolate potentially malicious user-provided text from the agent's logic, although it does instruct the agent to trace code context before trusting claims.
Capability inventory: The agent is authorized to "implement + commit" code changes, which is a high-impact capability that can be targeted by injection.
Sanitization: No explicit sanitization or filtering of comment content is described before it is used to inform code changes.
[INDIRECT_PROMPT_INJECTION]: The "Standing human verdicts override" logic introduces a specific injection target. It instructs the agent to treat the phrase "SAFE TO FIX" as an override that substitutes for "worth judgment" and tells the agent to "implement without second-guessing scope." While intended for authorized maintainers, this could be leveraged in an adversarial comment to trick the agent into bypassing certain safety constraints during the resolution process.

review-hog-resolution-criteria