The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external pull requests, including code diffs, descriptions, and commit messages. This data is ingested via GitHub CLI (gh pr view, gh pr diff) and processed by the agent to generate review findings.
Ingestion Points: The PR metadata and file patches are read into the context during Step 2 of the review process.
Boundary Markers: While no specific delimiters are used to isolate the diff content from instructions, the skill's persona is strictly defined as a reviewer.
Capability Inventory: The agent has the ability to read repository content and post PR comments using the gh tool.
Sanitization: No explicit sanitization of the PR content is performed before analysis.
Mitigation: The skill employs a strong human-in-the-loop (HITL) mechanism. Step 5 (Triage) and Step 7 (Confirm, then post) ensure the user reviews all findings and drafts before any external command is executed to post the feedback. This prevents malicious instructions within a PR from successfully hijacking the agent's actions without user oversight.
[COMMAND_EXECUTION]: The skill relies on shell commands via the GitHub CLI (gh) to perform its primary function.
Evidence: It uses commands such as gh pr view, gh pr diff, gh api, and gh pr comment for data retrieval and interaction.
Execution Method: The skill uses a scratchpad file and heredocs (<< 'EOF') to safely assemble the feedback comment before posting, which mitigates shell injection risks from the generated markdown content.

pr-review-lead