The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code from pull requests via gh pr diff and processes it to generate review comments. This creates a vulnerability surface for indirect prompt injection, where malicious instructions embedded in a PR could influence the agent's review or the verification process performed by the subagent.
Ingestion points: gh pr diff output (SKILL.md Step 4) and PR metadata retrieved from GitHub.
Boundary markers: The verification subagent (pi) is instructed to perform a 'Read-only task', but the untrusted diff is provided directly in the prompt context without strict isolation.
Capability inventory: The bot has write access to the repository's GitHub comments and review status via gh api, and performs local git operations.
Sanitization: No validation, escaping, or structural sanitization of the PR diff content is performed prior to processing.
[INDIRECT_PROMPT_INJECTION]: The skill relies on persistent 'ledgers' stored in /tmp/claude-review-ledgers/ to track findings and follow a review protocol. The use of a predictable, shared temporary directory could allow other local users on a multi-user system to pre-create or modify these ledger files, potentially influencing the bot's behavior, history, or protocol for specific pull requests.
[COMMAND_EXECUTION]: The skill executes various system commands including git, gh (GitHub CLI), and perl. It correctly uses isolated git worktrees (git worktree add --detach) to ensure that automated reviews are performed in a separate environment from the main codebase, which is a recommended security practice for automated code processing.

pr-review-bot