The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process pull request comments from GitHub, which are authored by external users. This creates a surface for indirect prompt injection where a malicious comment could attempt to influence the agent's behavior during the 'address each in code' step.
Ingestion points: Fetches inline and general PR comments via gh api and gh pr view (SKILL.md, Step 2).
Boundary markers: None present; the instructions do not include delimiters or warnings to ignore instructions embedded within the comments.
Capability inventory: The agent has capabilities to execute shell commands, write to the filesystem via git commit and code editing, and perform network operations via gh api and git push (SKILL.md, Steps 3-6).
Sanitization: No explicit sanitization or validation of the comment body is performed before the agent attempts to 'address' it.
[COMMAND_EXECUTION]: The skill uses gh api and git commands to interact with the repository and GitHub. While these are standard developer tools, they are used to perform actions based on the content of external comments. The use of $(cat <<'EOF' ...) in Step 6 to update the PR description is a safe pattern that prevents command injection into the shell, but the logic remains dependent on the data retrieved from the API.

resolve-review