The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process PR comments from any reviewer (human or bot), which constitutes untrusted external data. This creates a surface for indirect prompt injection where a malicious comment could attempt to influence the agent's behavior.
Ingestion points: SKILL.md (Step 3) and references/handoff-mode.md fetch comments using the gh CLI and GitHub GraphQL/REST APIs.
Boundary markers: The skill implements a strong mitigation in SKILL.md (Step 5) by requiring a mandatory triage approval gate. The agent must present a table of all triaged comments and rationales to the user and wait for explicit approval before executing any fixes or tool calls.
Capability inventory: The skill has access to the Bash tool, allowing it to run project tests, linters, and build commands. It also performs Git operations (git commit, git push) and GitHub API writes (gh api).
Sanitization: The skill uses jq to construct JSON payloads and utilizes --body-file for gh commands, which helps prevent shell injection when posting replies to GitHub.
[COMMAND_EXECUTION]: The skill identifies and executes project-specific safeguards (Step 1 and Step 6b) such as tests, linting, and compilation commands found in Makefile, README.md, or CI workflows. While these are executed to verify fixes, they involve running arbitrary commands defined within the local repository environment.

pr-review-loop