The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources and interpolates it into subagent prompts without sufficient protection.\n
Ingestion points: Pull Request body and diff content fetched via gh pr view and gh pr diff in Phase 2 of SKILL.md.\n
Boundary markers: Absent. The untrusted pull request content is placed directly into the subagent's prompt context without delimiters or instructions to ignore embedded commands.\n
Capability inventory: The skill can post comments to GitHub using gh pr comment and spawn subagents to perform code reviews.\n
Sanitization: Absent. There is no evidence of filtering, escaping, or validating the pull request content before it is processed by the AI.\n- [DATA_EXFILTRATION]: The skill automatically copies the PR triage table to the system clipboard using tools like pbcopy, xclip, or wl-copy. While intended for user convenience, this moves repository metadata outside the agent's immediate execution environment and could lead to accidental exposure of information if PR titles or bodies contain sensitive data.

pr-triage