The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data including local diffs, pull request content, and repository files. This content could contain malicious instructions intended to manipulate the agent's review verdict or behavior.
Ingestion points: SKILL.md (Workflow steps 4 and 6) and agents/code-reviewer.md describe reading repository files and PR data.
Boundary markers: The references/core-review-policy.md file defines a 'Verification Pass' and 'Confidence Filter' to ensure the agent relies on concrete evidence rather than potentially malicious patterns in the input.
Capability inventory: The skill uses git, gh (GitHub CLI), and the gitea skill to read files and post comments. It also performs network probes using curl or similar tools to identify Gitea version endpoints.
Sanitization: SKILL.md instructs the agent to 'Quote ref/path arguments and separate pathspecs with --' when using git commands to prevent argument injection.
[COMMAND_EXECUTION]: The skill uses shell commands (git status, git diff, gh pr review) to perform its primary function. These are standard tools for the described use case, but they operate on user-controlled file paths and branch names.

pma-cr