The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow defined in SKILL.md instructs the agent to run pnpm lint && pnpm test after implementing code changes. This capability executes scripts defined within the repository's package.json, which could be exploited if an attacker influences the code changes via malicious PR comments.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it reads and acts upon external, untrusted data from GitHub review comments.
Ingestion points: scripts/fetch_review_threads.py extracts comment bodies using the GitHub GraphQL API, which are then processed by the agent to decide on code changes.
Boundary markers: There are no explicit technical delimiters or instructions to the agent to treat the comment text as untrusted data or to ignore embedded instructions.
Capability inventory: The skill allows the agent to modify files, execute shell commands (pnpm), and perform network operations via the gh CLI (scripts/reply_review_thread.py).
Sanitization: While the references/keep-discard-rubric.md provides a logical framework for human-like triage, there is no automated sanitization or filtering of the comment content to prevent it from influencing the agent's logic.

gh-pr-review-responder