The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The 'Full review' workflow (Phase 2) clones the target Pull Request and executes commands like npm test, pytest, and go test on the PR's contents. This results in the execution of code provided by external contributors, which could be malicious.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) and git to interact with remote repositories, fetch PR data, and manage local worktrees for analysis.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it ingests and processes untrusted data from PR descriptions, discussion history, and code files to generate summaries and draft review comments.
Ingestion points: Untrusted data enters the agent context through gh pr view, gh api (comments/reviews), and by reading files within the PR worktree.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the processed PR data.
Capability inventory: The skill has access to shell execution (Bash), file system operations (Read, Write), and subagent delegation (Task).
Sanitization: There is no evidence of sanitization or filtering of external content before it is processed by the agent or passed to the analysis subagent.

pr