The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest and process untrusted external data, including pull request titles, bodies, and comments, via the gh pr view command. This content is interpolated into the agent's context and could potentially contain instructions intended to influence the agent's output or bypass its defined review guidelines.
Ingestion Points: Pull request metadata, descriptions, and comments are fetched in both 'Local CLI Mode' and 'GitHub Actions Mode' as defined in SKILL.md.
Boundary Markers: The skill utilizes specific XML-style tags such as <formatted_context>, <pr_or_issue_body>, and <comments> to delineate external data, which provides a level of separation between instructions and untrusted content.
Capability Inventory: The agent is authorized to execute gh and git commands and can spawn sub-agents to investigate the codebase, which could propagate injected instructions across multiple agent instances.
Sanitization: There are no specific instructions for the agent to sanitize or filter the content fetched from the pull request before processing it.

pr-review