The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub PR comments and reviews and uses this data to drive agent logic.
Ingestion points: The skill fetches review threads, top-level reviews, and issue comments using gh api and gh api graphql in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded within the fetched PR comments or review bodies.
Capability inventory: The skill has access to powerful CLI tools including gh (GitHub API), git, pnpm, and poetry (standard build/format tools), and it can write temporary state files to /tmp.
Sanitization: While the script uses jq to extract metadata and identifiers, the textual content of the reviews and comments is passed into the orchestration context and subsequent skill invocations without sanitization or escaping.

pr-polish