The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, diffs, and GitHub Pull Request metadata which could contain malicious instructions.
Ingestion points: Data is read from repository files, diffs, PR titles, bodies, and comments as specified in the workflow in SKILL.md.
Boundary markers: The skill defines a formal 'Untrusted data boundary' section with explicit instructions to treat all external inputs as data only and to ignore any embedded instructions.
Capability inventory: The skill utilizes git for local file operations and gh (GitHub CLI) for remote API interactions including viewing and posting comments.
Sanitization: The skill mandates the redaction of secret values, replacing them with [REDACTED] before inclusion in any output or dispatch.
[METADATA_POISONING]: The license field in the YAML frontmatter of SKILL.md references an external configuration file UPSTREAMS.json that is not present in the skill package.
[COMMAND_EXECUTION]: The skill uses the git and gh CLI tools to perform repository analysis and GitHub state management.
[DATA_EXFILTRATION]: The skill transmits review summaries and findings to GitHub using the gh tool's API capabilities as part of its core functionality.

code-review