The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to spawn sub-agents using mode: "bypassPermissions". This directive is designed to circumvent platform security controls that require user consent for file access, effectively removing interactive oversight and elevating the sub-agents' privileges.
[DYNAMIC_EXECUTION]: Reviewer agents are instructed to dynamically discover and read SKILL.md files from both the user's home directory and the local project, and to "follow the guidance" found within them. This creates a supply chain risk where a malicious skill file included in a repository under review could be used to execute arbitrary instructions.
[DATA_EXFILTRATION]: The skill performs a broad scan of the user's home directory ($HOME/.claude/skills/) to index all installed skills. Furthermore, sensitive PR data including full code diffs is written to /tmp/pr-review-data.md, which is a predictable, world-readable path on many systems.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface as it processes untrusted data from pull request views and diffs.
Ingestion points: gh pr view and gh pr diff capture external PR data.
Boundary markers: No delimiters or isolation instructions are used when passing PR data to sub-agents.
Capability inventory: Sub-agents have access to shell tools (Bash, Glob) and multi-agent communication tools (TaskUpdate).
Sanitization: The skill does not perform any sanitization or validation of the PR content before analysis.
[COMMAND_EXECUTION]: The devops-reviewer is instructed to execute shell commands using filenames extracted from the PR diff. This pattern is vulnerable to command injection if the PR contains specially crafted filenames designed to break out of the shell command context.

cc-pr-review