The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and summarizes untrusted content from GitHub pull requests and diffs.
Ingestion points: The skill retrieves external data using gh pr view (PR titles/bodies) and gh pr diff (code changes) in Steps 1 and 2.
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to ignore instructions that might be embedded within the PR content or code comments.
Capability inventory: The agent has write access to external communications via slack_send_message and the ability to modify PR state via gh pr edit --add-reviewer.
Sanitization: No sanitization or filtering of the ingested GitHub content is performed before it is used to synthesize messages.
[COMMAND_EXECUTION]: The skill relies on the gh CLI to perform GitHub operations.
While the skill uses parameterized commands (e.g., gh pr view <ref>), it requires the agent to execute shell commands. This is part of the core functionality but increases the attack surface if user input is not properly handled by the underlying agent platform.
[EXTERNAL_DOWNLOADS]: The skill requires external dependencies including the gh CLI and Slack/Atlassian MCP servers.
These tools are provided by well-known, trusted organizations (GitHub, Slack, Atlassian) and do not represent a malicious dependency risk in themselves.

share-pr