The Agent Skills Directory

[Indirect Prompt Injection]: The skill is designed to process untrusted data from pull request diffs, metadata, and comments. This data ingestion creates a surface where malicious instructions could be embedded in a PR to attempt to bypass the automated review. The skill mitigates this by instructing the agent to treat such attempts as injection signals and by restricting the execution environment. Ingestion points: The skill reads from /tmp/greenlight-pr.diff, /tmp/greenlight-pr.json, and the ./pytorch directory. Boundary markers: The instructions explicitly warn the agent that all inputs are untrusted and provide criteria for identifying and rejecting injection attempts. Capability inventory: Tool access is limited to Read, Glob, Grep, and Write. Network access, shell commands, and git operations are disabled. Sanitization: The output is strictly limited to a predefined JSON schema at a fixed path, preventing the agent from performing unauthorized actions or formatting.

greenlight-review