The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill directs the agent to execute a script located at .gitnexus/run.cjs within the target repository. Because the repository content is considered untrusted ('hostile review data'), this allows a malicious repository to achieve arbitrary code execution via the node command.
Evidence: node .gitnexus/run.cjs analyze --index-only in SKILL.md.
[COMMAND_EXECUTION]: The skill makes extensive use of system commands including git, gh, node, and npx. These tools provide a broad capability set that could be misused if the agent's logic is subverted by malicious input in the code being reviewed.
Evidence: Multiple references to git, gh pr view, and npx gitnexus throughout SKILL.md.
[DATA_EXFILTRATION]: The skill interacts with the GitHub CLI (gh) and attempts to access the user's local agent configuration directory (~/.claude/agents/). This exposure of sensitive file paths and credential-linked tools creates a risk of data exfiltration.
Evidence: Accessing ~/.claude/agents/ and using gh api commands in SKILL.md.
[PROMPT_INJECTION]: The skill possesses a large attack surface for indirect prompt injection as its primary function is to ingest and analyze untrusted data (diffs and source code). While it includes instructions to ignore embedded commands, the high level of tool access makes this a notable vulnerability.
Ingestion points: PR URLs, repository source code, and diff files (SKILL.md).
Boundary markers: Present (Explicitly labels repository content as 'hostile review data').
Capability inventory: Command execution (node, npx, git, gh) and file system access.
Sanitization: Absent for the execution of the repository-provided run.cjs script.

gitnexus-review