The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill analyzes untrusted content from pull request reviews and comments, which could contain malicious instructions.
Ingestion points: SKILL.md uses gh pr view and gh api to fetch reviews and comments from external GitHub repositories.
Boundary markers: Absent. The instructions do not tell the agent to ignore or delimit instructions found within the PR data.
Capability inventory: The skill uses Bash, Write, and Read tools, providing a surface for actions if an injection is successful.
Sanitization: None. Data is processed as raw strings for pattern identification.
[Command Execution] (LOW): The skill uses shell commands with interpolated variables which could be exploited if not sanitized.
Evidence: SKILL.md instructs the agent to run gh pr list -R <owner/repo> and gh pr view <number>.
Risk: If an attacker provides a malicious string for the repository or PR number (e.g., repo; rm -rf /), it could lead to command injection depending on the agent's execution environment.

pr-retro