The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface that could be targeted by indirect prompt injection through malicious pull request comments or summaries.
Ingestion points: The scripts/review-threads.mjs script fetches reviewThreads, aiSummaryComments, and issueComments from the GitHub API.
Boundary markers: Instructions explicitly require the agent to delimit the evaluation process (Step 9) and follow a disciplined verification process defined in references/review-discipline.md.
Capability inventory: The skill is granted broad permissions including Edit, Write, and shell access for git, gh, node, pnpm, and npx.
Sanitization: The skill minimizes risk by utilizing a custom Node.js script to filter and structure feedback into a minimal JSON format, reducing the likelihood of processing extraneous or malicious payload content. It further requires the agent to technicaly verify all findings against the actual codebase before implementation.
[COMMAND_EXECUTION]: The skill relies on the gh and git command-line interfaces to perform its primary functions, including viewing pull requests, fetching CI logs, and committing code fixes. These tools are scoped to the skill's specific purpose and are managed through documented configuration knobs.
[SAFE]: The skill provides specific instructions for the agent to "stay quiet" and use background processes when watching CI jobs. These are evaluated as legitimate user experience optimizations for the Claude Code platform to prevent terminal output saturation during long-running tasks, rather than attempts at malicious concealment.
[SAFE]: Automated workflows such as the promoteOnGreen feature (flipping a draft PR to ready) are governed by strict guardrails, including verification of terminal success on all required CI checks, the absence of unresolved human threads, and the lack of base-branch drift.

triage-pr