The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull request diffs, commit messages, and ticket descriptions to perform its review. An adversary could craft a malicious pull request or ticket containing instructions designed to subvert the agent's logic, such as instructing the agent to ignore specific checklist failures. 1. Ingestion points: gh pr view, gh pr diff, and ticket text. 2. Boundary markers: No delimiters or instructions to treat data as inert are present. 3. Capability inventory: The skill can read local files, execute shell commands (git, gh), and post comments to pull requests. 4. Sanitization: The skill mentions masking secrets but does not sanitize natural language instructions from input data.- [DYNAMIC_EXECUTION]: The skill uses an "overlay" mechanism that loads and prioritizes instructions from a path specified by the $POWERSUIT_OVERLAY environment variable. This allows the skill's core logic to be modified or overridden by external files, which could introduce malicious behavior if the overlay directory is compromised.- [COMMAND_EXECUTION]: The instructions direct the agent to execute a "pre-PR command" found within docs/sdlc.md. Executing shell commands defined in external documentation files constitutes a risk of arbitrary command execution if the content of that document is not strictly controlled.

change-review