The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to fetch and checkout Pull Request branches (git fetch origin pull/$PR_NUMBER/head:pr-$PR_NUMBER) and subsequently execute automated tests or linters like pytest, npm test, or ruff check (SKILL.md). This poses a high risk of remote code execution because Pull Request branches can contain malicious code embedded in the test suite or project configuration files by external contributors.
[CREDENTIALS_UNSAFE]: The setup logic in SKILL.md programmatically extracts a GITHUB_TOKEN by reading sensitive local files including ~/.git-credentials and ~/.hermes/.env using grep and sed. Accessing these sensitive file paths exposes private authentication secrets to the agent's operating context.
[COMMAND_EXECUTION]: The skill frequently uses shell pipes to process JSON data from the GitHub API using python3 -c. This execution model is vulnerable to injection if the remote data contains characters that could break out of the Python string or shell command context during interpolation.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from GitHub PRs. Ingestion points: PR metadata (title, body) and file diffs via gh pr view, curl, and git diff (SKILL.md). Boundary markers: None identified; untrusted data is processed directly as part of the review context. Capability inventory: Subprocess execution (pytest, npm test), file system reads (read_file), and network operations (curl) (SKILL.md). Sanitization: No evidence of escaping or validation of external PR content before processing.

github-code-review