The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script post-review.js utilizes execSync with template literals to construct and execute shell commands (e.g., gh api repos/${owner}/${repo}/pulls/${PR_NUMBER}/reviews/${reviewId}). This pattern is highly susceptible to command injection if environment variables or data returned from previous API calls contain shell metacharacters.
[PROMPT_INJECTION]: The skill processes untrusted input in the form of PR diffs and source code, creating an indirect prompt injection surface.
Ingestion points: The agent ingests PR diffs (SKILL.md) and reads entire source files for context (references/bug.md).
Boundary markers: None identified; the agent lacks instructions to isolate untrusted code from its own operational logic.
Capability inventory: The agent is authorized to execute gh and git commands as part of the review workflow.
Sanitization: No validation or escaping of the diff content is performed before processing.
[DATA_EXFILTRATION]: The post-review.js script is designed to print the full review.json payload to stderr if the GitHub API call fails. This behavior could inadvertently expose sensitive findings or repository metadata in CI/CD logs.
[COMMAND_EXECUTION]: Instructions in SKILL.md direct the agent to execute shell commands using the $PR_NUMBER variable. If this variable is not strictly sanitized by the host platform, it presents a risk of arbitrary command execution when the skill is loaded or run.

cc-pr-review-ci