The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted data from GitHub pull requests, which creates a surface for indirect prompt injection attacks where malicious instructions in a PR could influence the agent's behavior.
Ingestion points: The agent reads PR descriptions, metadata, and existing comments via gh pr view and scripts/get_pr_comments.sh, and reviews codebase changes locally during the review workflow.
Boundary markers: The instructions mandate a AGENT: prefix for all comments and require explicit, written confirmation from the user in the chat before any content is posted to a PR, providing a manual oversight layer.
Capability inventory: The skill possesses the capability to modify the local filesystem (checkout and edit files in the local review workflow) and interact with the GitHub API to post, reply to, and resolve comments.
Sanitization: There is no evidence of explicit sanitization or filtering of the content fetched from pull requests before it is processed by the agent or incorporated into review outputs.
[COMMAND_EXECUTION]: The skill relies on a suite of bash scripts to interact with the GitHub CLI (gh) and manipulate local state.
The scripts use jq to manage JSON-based state files in /tmp/ (e.g., scripts/post_inline_comment.sh and scripts/submit_pr_review.sh).
While the scripts use defensive shell programming (set -euo pipefail), they demonstrate a capability to execute system commands based on parameters like PR numbers and file paths derived from the repository context.

PR Review