The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull requests, creating a surface for indirect prompt injection attacks.
Ingestion points: Pull request titles, descriptions, diffs, and comments are fetched via the gh CLI and Python scripts (e.g., scripts/fetch-pr-data.sh, scripts/run-pr-checks.py).
Boundary markers: Absent; untrusted content is interpolated directly into the agent's context without clear delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has access to Bash, Read, Grep, WebFetch, and WebSearch tools, which could be abused if an injection is successful.
Sanitization: No sanitization or validation of the fetched PR content is performed before presentation to the agent.
[COMMAND_EXECUTION]: The skill uses dynamic context injection and instructs the agent to execute shell commands.
Dynamic Context Injection: The file scripts/review-pr.md uses the !command syntax to execute gh and git commands (e.g., !gh pr list, !git branch) at load time to populate context.
Argument Injection Surface: Instructions in scripts/review-pr.md direct the agent to execute gh pr view $ARGUMENTS, where $ARGUMENTS is a user-supplied PR number. This could lead to shell command or argument injection if the agent does not properly sanitize the input before execution.
Linter Execution: scripts/run-lint-check.sh and scripts/run-pr-checks.py execute local binaries (ruff, eslint, biome) based on files detected in the project environment.

code-review-playbook