The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub PR review comments and issue comments, which creates a surface for indirect prompt injection attacks where a reviewer could embed malicious instructions for the agent.
Ingestion points: GitHub PR review threads and issue comments are fetched via the gh api and processed as natural language instructions for the agent (SKILL.md, Step 3).
Boundary markers: Absent. While the skill requires a user approval gate for triage (Step 5), it lacks technical delimiters or explicit instructions to treat the fetched comment text as data rather than instructions during the initial triage phase.
Capability inventory: The skill possesses significant capabilities including file modification via git, arbitrary shell execution for project safeguards via Bash, and network write access via git push and gh api (SKILL.md, Steps 1, 6).
Sanitization: Absent. The raw text of external comments is analyzed and summarized into a triage table presented to the user without escaping or filtering.
[COMMAND_EXECUTION]: The skill automatically discovers and executes arbitrary shell commands defined within the local project environment (e.g., Makefile targets, test suites, and CI/CD workflow definitions) to verify code integrity.
Evidence: In Step 1 (Pre-flight), the skill is instructed to "Identify all required safeguards (tests, compilation, linting, formatting, etc.). Run all of them."
Context: While this is the intended purpose of the skill to ensure PR fixes don't break the build, it assumes the local repository's scripts (like Makefile or test files) are non-malicious.

pr-review-loop