The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches pull request media (screenshots/recordings) and shared review guides from GitHub and GitHub User Content repositories. These downloads are performed using the gh CLI and curl and are restricted to trusted GitHub domains.
[COMMAND_EXECUTION]: Executes standard command-line tools including git, gh (GitHub CLI), and curl to gather repository data, fetch PR information, and submit reviews. These operations are essential to the skill's stated purpose of providing an offline review interface.
[DYNAMIC_EXECUTION]: The build script evaluates the diagrams.js browser script within the Node.js environment to perform server-side validation of diagram data. This is an internal architectural choice to share code between the build process and the generated UI.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from PR descriptions and external review guides defined in a repository's REVIEW.md. While this presents an attack surface, the skill implements robust sanitization in its Markdown and SVG rendering engines (stripping scripts and event handlers) and follows a process where the user remains the final reviewer before any actions are taken on GitHub.

feature-review