The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request descriptions, comments, and repository files, which are then passed to a subagent for analysis. This creates a surface where a malicious PR could provide instructions that influence the subagent's behavior.
Ingestion points: Pull Request and Issue data fetched via gh pr view and gh issue view, and changed files read from the worktree in Phase 2.2.
Boundary markers: The subagent prompt uses structural headers but lacks specific instructions to disregard instructions embedded in the data.
Capability inventory: Access to shell commands, file system writes in /tmp/, and network operations via the gh CLI.
Sanitization: The instructions do not specify sanitization or escaping of the ingested data.
[COMMAND_EXECUTION]: The skill instructs the subagent to execute project-specific test and linting commands such as npm test and pytest on the code provided in the Pull Request. A malicious contributor could manipulate these commands by modifying the project's configuration files (e.g., package.json scripts), leading to the execution of arbitrary code when the tests are run.
[EXTERNAL_DOWNLOADS]: Fetches Pull Request metadata and repository code from GitHub's official services using the GitHub CLI (gh) and git.

pr