The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted Pull Request metadata (body, comments) and repository file contents which creates an indirect prompt injection surface. An attacker could potentially embed malicious instructions within a PR to influence the agent's behavior.
- Ingestion points: PR metadata and repository content are ingested via gh pr view and git clone in the scripts/ directory and SKILL.md workflows.
- Boundary markers: Absent. The instructions do not specify any delimiters or warnings to isolate PR data from the agent's core instructions.
- Capability inventory: Execution of local shell scripts, shell command execution via CLI tools, and local file system read/write operations.
- Sanitization: PR content is processed as-is without sanitization or validation of embedded instructions.
[COMMAND_EXECUTION]: The provided helper scripts (e.g., scripts/setup_pr_workspace.sh) execute shell commands using variables extracted from external PR data (such as repository owner, name, and branch names). Although variables are quoted, the lack of strict input sanitization represents a potential command injection vector if the agent is manipulated via the indirect injection surface.
[EXTERNAL_DOWNLOADS]: The skill performs repository cloning from GitHub using the git clone command. This is a legitimate and necessary operation for the skill's primary purpose and targets a well-known technology service.

pr-review