The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from GitHub Pull Request comments which may contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill fetches review comments using gh api repos/{owner}/{repo}/pulls/{number}/comments and reads full threads in SKILL.md.
Boundary markers: There are no specific delimiters or instructions provided to the agent to separate untrusted comment content from the core instructions.
Capability inventory: The agent is authorized to make code changes, perform git push operations (via referenced workflows), and execute GraphQL mutations to resolve threads.
Sanitization: The instructions advise the agent to "verify before applying," but there is no technical sanitization or filtering of the comment body to prevent prompt injection attacks.
[COMMAND_EXECUTION]: The skill utilizes the gh (GitHub CLI) tool to perform repository operations, including fetching comments, interacting with the GitHub API, and resolving threads via GraphQL. These commands are necessary for the skill's stated purpose of PR management.

address-feedback