The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from repository files (such as the diffs of the PR or branch being reviewed, REVIEW.md, and AGENTS.md) as well as user-provided instructions. This content is passed to a subagent for processing. There is a risk that malicious instructions embedded within the code being reviewed could influence the subagent's findings or output.
Ingestion points: gh pr diff, git diff, REVIEW.md, AGENTS.md, and user-provided additional reviewer instructions.
Boundary markers: The prompt template uses structure and formatting instructions, but lacks explicit directives to the subagent to ignore instructions contained within the code diff itself.
Capability inventory: The skill uses gh api and gh pr review to write comments to GitHub, and the Agent tool to spawn subagents.
Sanitization: There is no evidence of sanitization or validation of the subagent's output before it is used in subsequent shell commands.
[COMMAND_EXECUTION]: The skill executes shell commands via the gh CLI to post review comments. It interpolates JSON output generated by the subagent directly into these commands: gh api ... -f comments="<json from subagent>". If the subagent's output is manipulated or contains malicious shell metacharacters, and the platform does not properly escape the arguments, it could lead to command injection in the main session environment.

local-review