The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub PR descriptions and comments, which is then passed to subagents for analysis.
Ingestion points: PR metadata is retrieved in fetch-diff.md and passed as a 'task description' to subagents.
Boundary markers: Limited delimiters are used in the subagent prompt in SKILL.md, and there are no explicit warnings to ignore instructions within the description.
Capability inventory: Subagents are instructed to perform static analysis only and are forbidden from using tools.
Sanitization: No sanitization of the PR body or comments is performed before interpolation into prompts.
[COMMAND_EXECUTION]: The skill utilizes git and gh tools for workflow automation.
Evidence: fetch-diff.md and scripts/post_review.js execute CLI commands.
Security: post_review.js redacts sensitive data like authentication tokens from its output and validates command-line arguments to prevent injection.

comprehensive-review