The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests untrusted repository data (diffs and file contents) as part of its core review functionality.
Ingestion points: The collect-diff.ps1 script gathers information from git diff and reads untracked file contents using Get-Content, which are then passed into sub-agent prompts defined in SKILL.md.
Boundary markers: The skill uses structured templates to separate orchestrator instructions from the ingested diff content, although it lacks explicit delimiters or escaping for the code content.
Capability inventory: The orchestrator utilizes the platform's task tool to delegate analysis to specialized sub-agents and reports the consolidated results to stdout.
Sanitization: There is no explicit sanitization of the reviewed code content. A malicious actor could attempt to embed instructions within a Pull Request (e.g., in code comments or documentation) designed to influence the sub-agents into providing a biased or incorrect review.
Local Command Execution: The skill executes a bundled PowerShell script to interact with the local git environment.
Pattern: SKILL.md invokes pwsh -NoProfile -File .github/skills/pr-review/collect-diff.ps1.
Context: This script is a local component of the skill designed to provide a deterministic capture of the diff. It operates within the repository's scope and respects standard .gitignore rules when identifying untracked files, reducing the risk of accidental exposure of sensitive local files.

pr-review