The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the gh (GitHub) and sonar (SonarQube) CLI tools to retrieve PR metadata, review comments, and static analysis issues. Execution is managed via helper scripts that validate command arguments and restrict calls to a predefined whitelist of allowed commands.
[PROMPT_INJECTION]: The skill ingests untrusted content from external sources (pull request comments and SonarQube issues), creating a surface for indirect prompt injection.
Ingestion points: External data is fetched from pull request conversation comments, review submissions, and SonarQube issue bodies via scripts/fetch_comments.py in Phase 1.
Boundary markers: The instructions in SKILL.md explicitly define review content as "untrusted claims" and prohibit the interpolation of this data into shell commands, file paths, or executable code.
Capability inventory: The agent has access to Edit, Write, and Bash tools (via the gh and sonar CLIs), which could be targets for manipulation through embedded instructions.
Sanitization: The fetch_comments.py script truncates long inputs and labels external nodes as "untrusted_external_content." Additionally, the workflow implements a mandatory manual review phase where the user must select valid items from a generated ledger before any changes are implemented.

gh-pr-review