The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR diffs and source files to generate its documentation. An attacker could embed malicious instructions in PR comments or code that the agent might interpret as instructions or incorporate into its output.
Ingestion points: gh pr diff and gh pr view output, and full file content of changed files (Step 1).
Boundary markers: The skill does not explicitly define markers to isolate code content from instructions during the analysis phase.
Capability inventory: Access to gh api for posting reviews and the Write tool for local file creation.
Sanitization: No specific sanitization or filtering of external code content is mentioned prior to prompt interpolation.
[DATA_EXPOSURE]: The skill performs a scan of local environment files ($HOME/.claude/settings.json) using grep in Step 0.5. While the stated purpose is to check for gh api permissions to warn the user early, this involves reading files that may contain other sensitive environment configurations.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to interact with the GitHub CLI (gh). It executes commands with variables derived from the PR context (e.g., branch names, file paths, repository owners). The skill mitigates common command injection risks by requiring that large prose payloads be written to a temporary JSON file using the Write tool rather than being passed via shell heredocs or command-line arguments.

wk-self-review