The Agent Skills Directory

[SAFE]: The skill interacts exclusively with the local filesystem and GitHub (a well-known service) via the official gh CLI. The operations are consistent with the triaging purpose and are performed under the user's local authentication context.
[COMMAND_EXECUTION]: Shell commands are used to interact with git and gh. The skill follows security best practices by using stdin (--body-file -) to handle untrusted text from pull requests and issues, preventing shell injection vulnerabilities that could occur if third-party text were interpolated directly into command strings.
[PROMPT_INJECTION]: The skill addresses indirect prompt injection through a documented evidence chain:
Ingestion points: Data enters the context via gh issue list, gh pr list, gh pr view, and gh pr diff as described in SKILL.md and references/reviewing-prs.md.
Boundary markers: Safety Rule 7 explicitly instructs the agent to treat fetched content as data, ignore any embedded instructions, and act only on evidence rules.
Capability inventory: The skill possesses the capability to modify GitHub state (gh pr merge, gh issue close, gh issue comment, gh pr edit) and write local files (Write tool).
Sanitization: Safety Rule 8 prevents command injection by requiring that untrusted text never transits shell-interpolated strings, using stdin for content passing instead.
[REMOTE_CODE_EXECUTION]: While the skill spawns subagents (Agent tool) to perform PR reviews based on the rubric in references/reviewing-prs.md, these subagents are configured to be read-only. Their findings are saved to local Markdown files and are never posted back to GitHub or executed as code, maintaining a secure sandbox for analysis.

github-triage