The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain malicious instructions designed to manipulate the agent.
Ingestion points: The skill reads pull request summaries, file changes, git blame history, and project-specific AGENTS.md files across multiple steps.
Boundary markers: There are no explicit delimiters or instructions provided to the subagents to distinguish between the pull request data and the review instructions.
Capability inventory: The skill utilizes the gh (GitHub CLI) tool to fetch data and post comments, providing a write-access vector for potential attacks.
Sanitization: No sanitization, validation, or filtering of the pull request content or file contents is performed before the data is processed by the AI subagents.
[COMMAND_EXECUTION]: The skill uses the gh bash command to interact with GitHub, specifically to comment on pull requests. While this is functional for code review, the shell execution is triggered using information derived from untrusted external pull request data, which presents a risk if the agent's logic is subverted via injection.

code-review