The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which constitutes a surface for indirect prompt injection where malicious instructions could be embedded in the code or comments being reviewed.
Ingestion points: As described in SKILL.md, the agent reads potentially untrusted data from issue bodies, PR comments, CI logs, and external web pages.
Boundary markers: The skill contains an 'Instruction Trust' section that explicitly warns the agent to treat external content as untrusted and prohibits it from overriding the skill's core configuration or security policies.
Capability inventory: The skill utilizes git commands for local repository analysis and performs network writes via the GitHub API to submit review findings.
Sanitization: Per references/github-review-submission.md, the skill mandates the use of jq to construct JSON payloads for API calls, ensuring that untrusted text from findings is not interpolated directly into shell commands.
[COMMAND_EXECUTION]: The skill executes local shell commands to manage repository state and facilitate API communication.
Evidence: Utilizes git for diffing and commit resolution, and employs the GitHub CLI toolset (specifically gh or the vendor-specific gh-useotto) for submitting review reports to the code host.

ziw-code-review