The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted GitHub PR review comments, which are external data that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: load-pr-review.js fetches reviewer comments using the gh CLI.
Boundary markers: The skill uses explicit [USER_CONTENT_START] and [USER_CONTENT_END] markers to delimit untrusted data when passing it to background agents for triage.
Capability inventory: The skill possesses the capability to read local source code via git diff and write content back to the GitHub API via gh api replies.
Sanitization: The skill implements a robust sanitization routine by escaping literal delimiter strings found within the untrusted reviewer text, preventing attackers from prematurely closing content fences.
[COMMAND_EXECUTION]: The skill executes local system commands including gh, git, and jq to perform its core functions.
Shell Injection Protection: For write-back operations, the skill uses jq to safely build JSON payloads and writes them to temporary files. These files are then passed to gh api via the --input flag, effectively preventing shell injection or interpolation of untrusted review content.
[SAFE]: The skill follows security best practices by defaulting to an analysis-only mode and requiring explicit user opt-in (--mode fix) and human approval via AskUserQuestion before modifying any files or posting replies to GitHub. The use of an independent triage step with fresh context for each thread further reduces the risk of malicious influence across the session.

load-pr-review