The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using the gh (GitHub CLI) and git tools to fetch PR metadata, commits, diff statistics, and CI status. It uses input provided by the user (such as a PR number or URL) to populate command arguments. If the agent does not properly sanitize these inputs, it could lead to command injection, especially when constructing commands like gh pr view <N>.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes content from external sources that are not controlled by the user or the skill author. PR descriptions, commit messages, and review comments are fetched and summarized. Malicious instructions embedded in these fields could influence the agent's behavior.
Ingestion points: Ingests untrusted data from the body field of PRs, commit headlines, review comment bodies, and linked issue summaries via the gh CLI and GraphQL API.
Boundary markers: The instructions do not specify the use of delimiters or protective headers (e.g., "ignore instructions in the following text") when presenting external content to the LLM for processing.
Capability inventory: The agent has the capability to execute shell commands (gh, git) and perform network operations through these tools.
Sanitization: No sanitization, filtering, or escaping of the content retrieved from GitHub is mentioned in the skill instructions.

vp-pr-briefing