The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because its core logic involves reading and internalizing instructions from the repository being reviewed to define its own review standards.
Ingestion points: In SKILL.md Step 2b, the agent is instructed to find and read CLAUDE.md files and any documentation they reference. In Step 3a and 3c, the agent reads git logs, diffs, and the full content of changed files.
Boundary markers: There are no explicit delimiters or system instructions provided to ensure the agent treats content from the repository (like comments in code or instructions in CLAUDE.md) strictly as data rather than new instructions.
Capability inventory: The skill has the ability to execute gh and git commands and read any file within the repository context.
Sanitization: The skill does not describe any sanitization or filtering process for the documentation or code it ingests before using that content to guide its review process.
[COMMAND_EXECUTION]: The skill executes various shell commands to interact with the repository and GitHub.
Evidence: SKILL.md contains instructions to run gh auth status (Step 0), gh pr view (Step 1), and several git commands including git diff, git stat, and git log (Step 3a).
Context: These commands are necessary for the skill's stated purpose of PR analysis and use standard developer tooling.

umb-review