The Agent Skills Directory

[Indirect Prompt Injection]: The skill is designed to ingest and analyze external data such as pull request diffs, commit information, and source code files. This content, which can be provided by third parties, represents a surface where hidden instructions or malicious patterns could potentially be introduced to influence the agent's behavior during the review process.
Ingestion points: The skill uses git diff, git show, and gh pr view/diff to fetch external content into the agent's context (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or explicit 'ignore' directives to separate the code being reviewed from the agent's internal instructions.
Capability inventory: The skill utilizes shell commands for repository management and file system exploration.
Sanitization: No specific filtering or escaping mechanisms are described for processing the retrieved code content before it is analyzed by the agent.
[Command Execution]: The instructions direct the agent to construct shell commands using input variables (e.g., $ARGUMENTS for branch names, commit SHAs, or PR numbers). While this is the intended functionality for a git-integrated tool, it relies on the underlying platform to sanitize these arguments to prevent potential command injection where a user might attempt to append additional shell commands.

code-review