The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via the gh (GitHub), oc (OpenShift), curl, sed, grep, and uv utilities. These are used to fetch PR data, interact with cluster resources, and process local files.
[EXTERNAL_DOWNLOADS]: The skill downloads deployment manifests from the official Red Hat Developer Hub repository on GitHub and verifies container images on quay.io. These operations target infrastructure associated with the skill's vendor.
[PROMPT_INJECTION]: The skill processes untrusted content from pull request descriptions, comments, and linked issues, which creates a surface for indirect prompt injection.
Ingestion points: Untrusted text is retrieved from the changeRequest.body, existingComments, and linkedIssues fields in the PR context (defined in workflows/fetch-github.md).
Boundary markers: There are no explicit instructions or delimiters mentioned to separate untrusted PR data from the agent's instructions during analysis.
Capability inventory: The skill has the ability to post reviews to GitHub and modify resources on an OpenShift cluster.
Sanitization: The skill does not appear to perform sanitization or filtering of the ingested external content.
Mitigation: The skill enforces a mandatory mutation-gate (described in SKILL.md and workflows/post-to-github.md), ensuring that no external write operations occur without explicit user confirmation of the exact command and payload.

rhdh-pr-review