The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub pull requests (titles, bodies, comments, and diffs) and external services such as Linear, Slack, and Notion.
Ingestion points: Untrusted data enters the agent context via PR metadata, comments, file contents, and referenced external issues or threads.
Boundary markers: The skill includes explicit instructions for the agent to treat all repository and external content as untrusted input and specifically warns never to follow instructions found within these sources.
Capability inventory: The skill is capable of fetching repository metadata, reading source files using git, accessing external service data via specialized skills, and submitting reviews and comments to GitHub. It is strictly forbidden from executing repository code, build scripts, or CI commands.
Sanitization: The skill employs secure practices for handling output, using jq for JSON payload construction to ensure correct escaping and printf for generating temporary files to avoid shell expansion risks.
[SAFE]: The skill implements a strict 'read-only' posture regarding the target repository. It operates entirely through static analysis and metadata retrieval, explicitly prohibiting the execution of any project-specific code or automation scripts. This significantly limits the potential impact of processing malicious diffs.
[SAFE]: Data isolation is maintained through the use of per-run detached worktrees in temporary directories and a structured local cache for remote context. These mechanisms prevent state leakage between separate review tasks and ensure that sensitive information is handled within restricted scopes.

pr-issue-review