The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs the agent to skip the "Ask first" safety gate for repositories owned by a specific user (remorses). This explicitly overrides the standard human-in-the-loop requirement for taking actions on code repositories.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection by processing external, untrusted data.
Ingestion points: The agent is instructed to read PR descriptions, commit logs, and unresolved review threads using gh pr list, git log, and gh pr-review review view.
Boundary markers: There are no instructions provided to the agent to treat this external content as untrusted or to ignore any embedded instructions found within PR comments or review threads.
Capability inventory: The agent has broad capabilities to write back to the platform, including gh pr create/edit, gh issue create/edit/comment, gh release create, and replying to or resolving review threads.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from GitHub before the agent acts upon it.
[EXTERNAL_DOWNLOADS]: The skill depends on a third-party GitHub CLI extension, agynio/gh-pr-review. While the skill describes usage rather than providing a direct installation command, it introduces a dependency on external code that is not part of the standard toolset or a verified vendor list.

github-prs