The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior or the content of its reviews.
Ingestion points: The skill fetches pull request diffs, metadata (title, body, commits), and external doctrine files using the gh CLI as described in references/evidence-and-doctrine-lookup.md and SKILL.md Step 2.
Boundary markers: There are no explicit instructions to use delimiters or ignore instructions embedded within the ingested data, which increases the surface for indirect injection.
Capability inventory: The skill can perform shell commands, write to local scratchpad files, and post comments to GitHub repositories using gh pr comment as specified in references/output-and-posting-flow.md.
Sanitization: The instructions do not mention any sanitization, filtering, or escaping of the ingested PR content before it is processed by the LLM for analysis.
Mitigating Factor: The skill implements a robust human-in-the-loop workflow in Steps 5 and 7 of SKILL.md, requiring the user to triage findings and provide explicit confirmation before posting feedback, which prevents autonomous execution of injected instructions.

pr-review-lead