The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon untrusted data from GitHub PR comments and reviews.
Ingestion points: Workflow step 2 in SKILL.md fetches PR metadata, top-level comments, reviews, and review threads using gh api and GraphQL.
Boundary markers: No delimiters or instructions are present to distinguish untrusted external feedback from the agent's core system instructions.
Capability inventory: The skill is authorized to perform file system modifications (Workflow step 5) and execute shell commands including cmake, ctest, and git (Workflow step 6).
Sanitization: There is no evidence of sanitization or validation of the fetched content from GitHub before the agent uses it to determine its fixing strategy.
[COMMAND_EXECUTION]: The skill utilizes several command-line utilities to perform PR analysis and verification.
Evidence: Instructions include the use of gh api for data retrieval, gh pr checks for CI status, and cmake, ctest, and git diff for implementation verification.

fix-pr-comments