The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local shell script (scripts/collect-review-context.sh) and standard CLI tools (git, gh, rg) to gather repository state and code diffs. The script and instructions emphasize read-only operations and explicitly forbid destructive commands such as git reset or branch deletion.
[DATA_EXFILTRATION]: Interacts with GitHub via the git and gh CLI to fetch pull request data and diffs. This behavior is essential for the skill's purpose and is limited to trusted GitHub infrastructure, posing no exfiltration risk.
[PROMPT_INJECTION]: Contains a potential surface for indirect prompt injection as it ingests untrusted data from PR titles, bodies, and commit messages.
Ingestion points: Untrusted data enters the agent context through PR metadata and local repository documents (AGENTS.md, CLAUDE.md, etc.) as documented in SKILL.md.
Boundary markers: Subagent prompts in references/subagent-prompts.md use simple placeholders without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can execute read-only subprocesses and read arbitrary files within the repository scope.
Sanitization: No explicit sanitization of ingested text is performed before it is interpolated into subagent prompts.
[SAFE]: The skill architecture is robust, including detailed "Non-Negotiables" that prevent the agent from making mutations to the codebase, and the use of subagents provides clear task separation.

singular-code-review