The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources such as pull request descriptions, review comments, and CI logs, which constitutes an indirect prompt injection surface. A malicious contributor could theoretically embed instructions within a PR comment or intentionally failing log to influence the agent's code-fix behavior.
Ingestion points: The skill fetches PR content using gh pr view, review comments via gh api, and CI failure logs using gh run view --log-failed.
Boundary markers: The instructions do not define clear delimiters or specific warnings to the model to ignore instructions embedded within the processed PR data.
Capability inventory: The agent has the ability to checkout branches, commit changes, and push code to the remote repository (SKILL.md, references/fix-workflow.md). It also executes build and test scripts (npm run build, npm run test).
Sanitization: There is no explicit sanitization step described to filter or escape instructions from the retrieved PR metadata or logs before processing.
[COMMAND_EXECUTION]: The skill frequently executes shell commands to perform Git operations, interface with the GitHub CLI, and run project-specific build and test suites. These are core to its intended functionality for fixing pull requests.
[EXTERNAL_DOWNLOADS]: The skill synchronizes with GitHub repositories and downloads project dependencies via standard package managers (npm ci). These operations target the official project repository and well-known registries, which is standard developer behavior.

pr-review-fix