The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull request metadata, which could be used as a vector for indirect prompt injection to influence the agent's review logic or suggested fixes.
Ingestion points: SKILL.md (Step 1) instructs the agent to read PR titles, bodies, and comments using gh pr view, as well as linked issue content via gh issue view.
Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded commands when processing this external text.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh), write to the filesystem (via gh pr checkout or worktrees), and modify remote repositories (via gh pr review or pushing fixes).
Sanitization: No explicit sanitization or filtering of the text retrieved from GitHub is specified before the agent evaluates it.
[COMMAND_EXECUTION]: The skill relies on shell command execution for core functionality using git and the GitHub CLI (gh).
The instructions include a highly specific "Fork rule" designed to prevent the execution of untrusted code. It forbids checking out fork code into the active project tree and instead mandates the use of git show or isolated worktrees to view files without execution context (watchers, language servers, or build daemons).

review-pr