The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external, untrusted sources (GitHub Pull Requests) using the gh CLI. This creates a surface for indirect prompt injection attacks where an attacker could embed malicious instructions in a PR description or code changes to manipulate the agent's review logic.
Ingestion points: The scripts/pr-diff.sh script retrieves remote content via gh pr view and gh pr diff commands.
Boundary markers: The instructions in SKILL.md lack explicit guidance for the agent to use delimiters (e.g., XML tags or clear markers) or safety warnings when processing the retrieved PR content to differentiate instructions from data.
Capability inventory: The agent has the ability to execute the included shell script and interpret its output, which includes the raw text of PRs.
Sanitization: While the script uses jq for structured JSON output formatting, there is no semantic filtering or sanitization of the untrusted text content before it is presented to the model for review.
[COMMAND_EXECUTION]: The skill relies on a local shell script scripts/pr-diff.sh to interface with the GitHub CLI. The execution of shell commands using inputs such as the PR number and repository path constitutes a command execution surface, although it uses standard quoting to mitigate basic injection risks.

code-review-master