The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes data from external sources and has the authority to update the repository.\n
Ingestion points: The skill reads untrusted content from pull request comments and reviews via gh api in SKILL.md (Step 2) and references/external-feedback.md, as well as code diffs and repository instructions in SKILL.md (Step 1) and references/adversarial-review.md.\n
Boundary markers: There are no specific delimiters or instructions provided to the agent to treat external content as untrusted or to ignore embedded commands.\n
Capability inventory: The skill is authorized to perform git commit and git push operations in SKILL.md (Step 4), allowing it to modify the codebase based on injected instructions.\n
Sanitization: No validation or sanitization of the input data is performed before it is used by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill dynamically fetches and uses external review guidelines using the npx skills command.\n
Evidence: Steps in SKILL.md involve running npx skills find and npx skills use to incorporate third-party review logic.\n
Mitigation: The instructions mandate a 10,000+ install threshold for any external skill, which helps reduce the risk of using malicious or low-quality code.\n
Source: Content is sourced from standard registries like NPM and GitHub repositories, which are well-known services.\n- [COMMAND_EXECUTION]: The skill makes extensive use of local command-line tools to interact with the repository and pull request metadata.\n
Evidence: It executes git for commits/logging, the gh CLI for API interactions, and python3 for internal logic such as date formatting.

pr-review-loop