The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions state that the procedure "checks the PR out into a worktree and runs the gates." Running "gates" (automated tests or scripts) on code from a Pull Request involves executing potentially malicious code provided by an untrusted external contributor.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted data from Pull Requests (PR bodies, code comments, and documentation) which could contain instructions designed to bypass review policies or compromise the agent's environment during the "gates" execution phase.
Ingestion points: Pull Request head commits, docs/REVIEW-SWEEP.md, and REVIEW.md.
Boundary markers: No explicit markers or "ignore instructions" warnings are defined in SKILL.md to separate PR content from the agent's instructions.
Capability inventory: The agent is granted access to Bash, Write, Edit, and Read tools, and is instructed to execute repository "gates" (shell commands).
Sanitization: No sanitization, validation, or filtering of the PR content is described before execution or processing.
[COMMAND_EXECUTION]: The skill uses the Bash tool to read local documentation files (cat docs/REVIEW-SWEEP.md) and indicates that the agent will run shell commands as part of the PR "gates" workflow.

review-sweep