The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including GitHub pull request bodies, issue descriptions, and comments via gh pr view and gh issue view commands. This external content is used to inform the agent's root cause analysis and fix evaluation, creating a surface where an attacker could embed malicious instructions to influence the agent's behavior.
Ingestion points: Untrusted text is ingested from pull request data (title, body, comments) and issue data (title, body, comments).
Capability inventory: The skill possesses powerful capabilities including Edit (for local file modification), Bash (for command execution), and gh api (for posting automated review comments to GitHub).
Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore' warnings when presenting this untrusted data to subagents.
Sanitization: There is no requirement in the skill logic to sanitize or escape the content of PRs or issues before processing.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute a variety of version control and GitHub CLI commands. This includes reading repository history, fetching diffs, and searching for issues. Some commands incorporate data extracted from the environment or PR metadata (e.g., branch names, issue numbers, test names) which could lead to command injection if not handled strictly by the agent.
[DATA_EXFILTRATION]: The skill is configured to post automated review summaries and inline comments back to GitHub using the gh api POST method. While this is a primary feature of the skill, it represents a mechanism where local data (review findings, code snippets) is transmitted to an external service. The use of an AI watermark and user-approval steps (when available) mitigates the risk of unauthorized or deceptive posts.

review