The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted data from external platforms (Linear issue descriptions/criteria and GitHub PR comments from the Devin AI reviewer). This external content is used to guide the reasoning of the audit and fix subagents. While the risk is mitigated by human approval gates and the use of fresh, isolated sessions for each audit, a sophisticated attacker could attempt to craft malicious issue descriptions or comments to influence the generated code.
Ingestion points: Linear API (get_issue tool), GitHub PR reviews via the GitHub CLI (gh pr reviews), and specific comment extraction via the GitHub API.
Boundary markers: The workflow utilizes a strict 'Audit Report Contract' for inter-agent communication and enforces fresh subagent sessions to prevent context bleed.
Capability inventory: The orchestrator and its delegated agents have the capability to write to the filesystem (code fixes, version updates, changelog entries), execute shell commands (npm, node, git), and perform network operations (git push, gh pr create).
Sanitization: There is no evidence of explicit sanitization or filtering of the external text strings from Linear or GitHub before they are processed by the LLM subagents.
[COMMAND_EXECUTION]: The skill executes various local commands to automate development tasks. This includes git for repository management, gh for GitHub interactions, and npm for running tests and linters. It also executes a project-specific versioning script (node scripts/version.mjs). These commands are standard for the skill's documented purpose, and critical operations such as version bumping and final code commits are gated by mandatory human confirmation.

review-issue