The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Step 2 of the process in SKILL.md instructs the agent to gather data from PR titles, bodies, comments, diffs, linked issues, specs, PRDs, and repository-local instruction files such as AGENTS.md and CLAUDE.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed data are provided.
Capability inventory: The skill uses shell commands via the gh CLI tool (e.g., gh api and gh pr review in references/posting.md) to post reviews and comments to GitHub.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed or used in decision-making.
[COMMAND_EXECUTION]: The skill executes shell commands using the GitHub CLI (gh) to interact with pull requests.
Evidence: references/posting.md contains instructions to use gh api and gh pr review to submit review data. While this is the primary purpose of the skill, the execution happens in a context where indirect prompt injection could potentially manipulate the command parameters or the content being posted.

snap-review