The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via the GitHub CLI (gh) to fetch pull request metadata, file patches, and discussion comments. It also uses python3 -m http.server to start a local web server on 127.0.0.1 to serve the generated review page.
[DYNAMIC_EXECUTION]: A Python script is executed via a heredoc in the assembly phase to read temporary files from /tmp, perform string replacements (injecting CSS, JS, and HTML body), and write the final HTML file. This script includes basic character escaping to prevent JSON data from breaking HTML script tags.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub (PR bodies and comments) which could contain malicious instructions or XSS payloads meant to trigger when the reviewer opens the generated walkthrough.
Ingestion points: Data retrieved from gh api calls as described in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions for the agent to distinguish between PR data and control instructions during the HTML body generation.
Capability inventory: The skill can execute subprocesses (gh, python3) and write files to the /tmp directory.
Sanitization: The renderer.js file includes a basic esc() function for diff content, and the Python assembly script uses character substitution for JSON embedding, but the primary HTML body generated by the agent is not strictly sanitized.

cursor-cursor-team-kit-pr-review-canvas