The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from GitHub pull request comments and reviews to summarize them and apply code fixes. This allows an external contributor to potentially inject instructions that override the agent's behavior during the 'Apply fixes' step.
Ingestion points: The scripts/fetch_comments.py script retrieves the body field from PR comments, reviews, and reviewThreads via the GitHub GraphQL API.
Boundary markers: Absent. The instructions in SKILL.md interpolate this data directly into the conversation without delimiters or warnings to ignore embedded instructions.
Capability inventory: The agent is tasked with writing code changes to address comments and uses the gh CLI for repository interaction.
Sanitization: None identified in the provided scripts or instructions.
[COMMAND_EXECUTION]: The scripts/fetch_comments.py script uses subprocess.run to execute multiple gh CLI commands (gh auth status, gh pr view, gh api graphql). While it uses a list of arguments to mitigate shell injection, it still performs programmatic command execution.
[PRIVILEGE_ESCALATION]: The skill documentation explicitly requests that the user provide workflow and repo scopes when authenticating with the GitHub CLI. The workflow scope provides significant privileges, including the ability to modify CI/CD pipelines, which may exceed the minimum requirements for simply reading and addressing PR comments.

gh-address-comments