The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it analyzes external data from GitHub Pull Requests and codebase files without establishing security boundaries. A malicious pull request could include embedded instructions that the agent might inadvertently follow.
Ingestion points: Untrusted data enters the context via gh pr view, grep, and file-reading tools like Read and Glob.
Boundary markers: Absent. The prompt does not define clear delimiters or instruct the agent to ignore instructions found within the PR content.
Capability inventory: The agent can execute shell commands via Bash, interact with GitHub via gh, and utilize IDE tools.
Sanitization: Absent. There is no logic provided to sanitize or escape data retrieved from external sources.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run commands like gh pr list, gh pr view, and grep. These tools are used for legitimate analysis but provide a broad execution surface that could be leveraged if the agent's instructions are compromised via the indirect injection vector.

pr-reviewer