The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is instructed to read and process untrusted external data, specifically pull request titles, bodies, linked issues, and commit messages to determine if the changes deliver their 'stated intent'.
Ingestion points: SKILL.md (Section 6) and scope-resolution.md (Pull requests section) direct the agent to ingest content via gh pr view.
Boundary markers: Absent. There are no instructions to use delimiters or to treat the ingested text as untrusted content that should not be followed as instructions.
Capability inventory: The skill possesses extensive shell capabilities via git (blame, diff, show, worktree, fetch) and gh (view, status), and it can read any file within the repository scope.
Sanitization: Absent. No sanitization, escaping, or validation steps are provided for the content retrieved from GitHub.
[COMMAND_EXECUTION]: The skill constructs and executes numerous shell commands using variables like branch names, PR numbers, line numbers, and file paths which are often derived from user input or external metadata.
Evidence: SKILL.md includes templates such as git blame -L <line>,<line> "$BASE"..<head-ref> -- path/to/file.
Evidence: scope-resolution.md utilizes dynamic fetching: git fetch origin "pull/<n>/head:refs/remotes/pr/<n>".
Evidence: SKILL.md creates temporary worktrees based on PR numbers: git worktree add /tmp/review-<n> refs/remotes/pr/<n>. While standard for development tools, these represent an attack surface if the underlying shell execution environment does not properly sanitize arguments.

interface-review