The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from code diffs and pull request metadata but implements effective mitigations.
Ingestion points: The skill ingests diff text, commit logs, and PR metadata (titles, bodies, and comments) via git and gh CLI tools as shown in SKILL.md and scripts/full-code-review.js.
Boundary markers: Prompts for the various reviewer agents (Structural, Security, DevEx, Cross-commit) explicitly label the diff as untrusted input and use triple-backtick delimiters to separate the code from the instructions. The agents are specifically instructed to ignore any commands or instructions found within the code or metadata.
Capability inventory: The skill is designed as a read-only reporting tool. It is constrained to git and gh read operations and does not have the capability to write to the filesystem, execute arbitrary shell commands, or perform network operations outside of the established GitHub CLI context.
Sanitization: The scripts/full-code-review.js file implements a redactSensitiveText function that uses regular expressions to strip API keys, tokens, passwords, and emails from the input before it is sent to the LLM.
[SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill follows security best practices by using an adversarial verification phase to refute potentially false or malicious findings and adhering to the principle of least privilege.

full-code-review