The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted data from the pull request changes and project-specific instruction files.
Ingestion points: Content returned by git diff and the text of project documentation files such as CLAUDE.md, AGENTS.md, and README.md found within the pull request scope.
Boundary markers: The instructions lack explicit delimiters or warnings to the sub-agents to ignore or isolate potential instructions embedded within the code or markdown content being reviewed.
Capability inventory: The agent can execute shell commands (git, gh), launch parallel LLM agents, modify pull request descriptions, and post inline comments to GitHub.
Sanitization: There is no evidence of sanitization or validation of the input data before it is processed by the specialized review agents.
[COMMAND_EXECUTION]: The skill utilizes system commands including git status, git diff, and gh api. While necessary for the skill's primary function, these tools provide a capability that could be manipulated if an attacker successfully influences the agent's behavior via injected instructions.

review-pr