The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (diffs, PRs, issue comments), creating a potential attack surface where malicious content in a PR could attempt to influence the agent's behavior.
Ingestion points: Content is ingested through tools like gh pr view, gh issue view, and git diff as described in SKILL.md and references/mode-triage.md.
Capability inventory: The agent has capabilities to modify files, commit, and push to repositories (though protected by authorization rules).
Boundary markers: The instructions require verification of all claims against live shell output, which provides a check against hallucinated or injected instructions.
Sanitization: No explicit programmatic sanitization of external data is defined before it is included in the agent's context.
[COMMAND_EXECUTION]: The skill executes local shell commands to perform repository audits and run tests.
Evidence: scripts/audit_signals.py and scripts/release_gate.py execute git commands using subprocess.run to gather project information.
Evidence: scripts/run-tests.sh executes project-specific test commands (e.g., npm test, cargo test, pytest) based on detected project files.
Context: These commands are used for their intended purpose within a code-review workflow and do not involve shell injection vulnerabilities.

check