The Agent Skills Directory

[PROMPT_INJECTION]: The skill is highly susceptible to Indirect Prompt Injection because it is designed to automatically discover and load instructions from the repository it is reviewing.\n
Ingestion points: gh pr diff, .claude/skills/, .cursor/skills/, docs/**, and external Jira/Linear tickets.\n
Boundary markers: None specified; discovered content and project-local skills are passed to subagents as context without isolation or explicit "ignore" directives.\n
Capability inventory: The agent uses the gh CLI (full read/write access to PRs and issues), the Task tool (spawning concurrent sub-agents), and general filesystem access.\n
Sanitization: The instructions do not require sanitizing or escaping the untrusted strings discovered in manifest files or convention docs before they are interpolated into subagent prompts.\n- [COMMAND_EXECUTION]: The skill probes the reviewed repository for test runner commands and CI configurations (e.g., package.json scripts, .github/workflows/*) and stores these as a "DISCOVERY MAP". While the instructions intend these for context, passing raw command strings from an untrusted PR to an LLM creates a significant risk of command injection if the agent attempts to execute them.\n- [PROMPT_INJECTION]: The orchestration logic contains directives that can be used to hide the agent's identity (Rule 8: "No attribution") and uses invisible HTML comment markers (e.g., ) for metadata. These techniques can be used to conceal AI-generated actions from the end user.

pr-review