The Agent Skills Directory

[SAFE]: The skill performs its primary function using established system tools (gh CLI). No malicious code, credential theft, or unauthorized network operations were detected.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted data from Pull Request diffs, descriptions, and comments.
Ingestion points: Data enters the system via gh pr view and gh pr diff commands as specified in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore malicious commands embedded within the PR data.
Capability inventory: The skill uses gh for data retrieval and has the capability to read local files (source code, documentation, and configuration) as described in SKILL.md.
Sanitization: There is no explicit sanitization of the PR content before it is processed for review. While this presents a surface for potential instruction override, it is a common risk for this use case and does not indicate malicious intent by the author.

pr-review