The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes gh CLI and jq commands to interact with GitHub APIs and process JSON data. These operations are conducted using a safety-first pattern: JSON payloads are constructed using jq to prevent shell injection, stored in temporary files, and passed to the gh api command using the --input flag. This avoids direct shell interpolation of potentially untrusted comment content.- [COMMAND_EXECUTION]: The skill implements a cryptographic integrity check in scripts/pr-comment.js using a nonce and SHA-256 hash. This ensures that the review payload submitted in the second phase exactly matches the data validated and previewed by the user in the first phase, preventing the agent from being tricked into submitting modified content.- [COMMAND_EXECUTION]: A 'SHA drift' check is performed before submission. The script re-fetches the latest commit SHA from the pull request and compares it against the SHA used during preparation. If they differ (indicating the PR was updated), the skill aborts with a specific exit code (3), prompting the agent to restart the validation and confirmation flow.

pr-comment