The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process pull request comments and review threads which constitute untrusted external data. While the 'grill' process involves human-in-the-loop validation, malicious instructions embedded in PR comments could attempt to influence the agent's behavior during the review or triage phases.
Ingestion points: Comments are fetched using gh pr view and processed in SKILL.md during the 'Collect all unresolved feedback' step.
Boundary markers: The skill uses markdown blockquotes to display feedback but lacks explicit 'ignore embedded instructions' delimiters for the untrusted content.
Capability inventory: The agent has access to the Bash tool, allowing for file system modifications and network operations via the gh CLI.
Sanitization: No explicit sanitization or filtering of comment bodies is mentioned beyond metadata filtering (e.g., bot summaries).
[COMMAND_EXECUTION]: The skill relies on the gh CLI and git for repository operations. It executes commands such as gh pr status, gh pr view, and various git operations. While these are standard for the tool's purpose, they represent a significant capability set that could be abused if the agent's instructions were compromised.
[DYNAMIC_EXECUTION]: During the 'Pre-flight' phase, the skill dynamically identifies and executes project safeguards such as Makefile, .github/workflows/, and other scripts. If a malicious pull request modifies these configuration files, the agent might execute untrusted code while attempting to 'confirm a healthy baseline'.
[DATA_EXPOSURE]: The skill writes local state (including PR details and triage decisions) to a .pr-review/triage.json file. While the instructions mandate that this directory be gitignored to prevent accidental credential leakage (if a developer were to store secrets there against the skill's warnings), it remains a local data artifact.

pr-review-grill