The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue and pull request bodies, which could theoretically contain malicious instructions designed to influence the agent's behavior during the review process.
Ingestion points: The github-facts.ts module fetches issue and pull request content via the GitHub API and provides it to the agent context.
Boundary markers: The skill attempts to mitigate injection risks by using specific HTML comments (e.g., ) to separate its own metadata from human-authored content.
Capability inventory: The skill has significant capabilities, including executing shell commands (git, gh, npm) via prepare-review.mjs, which are used for checkout management and running verification scripts.
Sanitization: The skill performs basic escaping of markers (e.g., replacing --> with --\u003E) within rendered metadata blocks to prevent structure-breaking injections.
[COMMAND_EXECUTION]: The skill executes external tools including git, gh, and Node.js package managers (npm, pnpm, yarn, bun).
Commands are executed using argument arrays with execFile and spawnSync, avoiding the risks associated with shell interpolation.
The environment passed to these commands is sanitized to remove dangerous variables such as LD_PRELOAD and NODE_OPTIONS.
Execution is restricted to established project scripts and frozen installation commands, providing a limited operational boundary.
[DYNAMIC_EXECUTION]: The skill uses dynamic imports to load its own internal components at runtime.
Components like prepare-review.mjs and publish-review.mjs dynamically import bundled TypeScript files from the local installation directory using pathToFileURL.
While these paths are computed from the skill's own installation root, dynamic loading is a technique that warrants awareness.

review-this