The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill processes untrusted input in the form of pull request diffs fetched from an external source. Because this content is supplied via PR changes, code comments or string literals within the diff could theoretically contain adversarial instructions designed to influence or mislead the agent's evaluation logic during the review phase.
Ingestion points: In Step 1 (SKILL.md), the agent retrieves the PR content via gh pr diff <PR_NUMBER> and outputs it to temporary files (/tmp/api-diff.txt and /tmp/full-diff.txt) for analysis.
Boundary markers: The instructions do not define distinct delimiters or strict separation guidelines to instruct the underlying model to ignore embedded code instructions while performing its review.
Capability inventory: The skill leverages system commands to create local script files and uses the gh api CLI tool to submit automated review updates or post comments back to GitHub.
Sanitization: Explicit input filtering or sanitization steps for the text inside the code diff are absent.
[Command Execution]: The skill requires the execution of system CLI commands (gh and git) to perform its task of auditing public API surfaces.
Evidence: Steps 1, 4, and 6 define shell invocations including gh pr diff, git grep, git blame, and gh api to parse changes, attribute code authors, and publish review reports. This represents a functional requirement of the skill but constitutes an execution surface that relies on proper validation of inputs like parameters and pull request numbers.

api-review