The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the lead agent to spawn all sub-agents using mode: "bypassPermissions". This is a direct attempt to circumvent the platform's security model, which typically requires user authorization for sensitive actions like reading files or executing commands.
[DATA_EXFILTRATION]: The skill instructions require the agent to scan and read the SKILL.md files for all skills installed in both the user's home directory ($HOME/.claude/skills/) and the local project directory. This behavior exposes the logic and potential secrets of other agents installed on the system to the current skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data from GitHub pull requests and pass it to multiple sub-agents.
Ingestion points: Output from gh pr view and gh pr diff in SKILL.md.
Boundary markers: The PR data is stored in /tmp/pr-review-data.md and then read by sub-agents without any sanitization or clear delimiters to separate untrusted content from instructions.
Capability inventory: Sub-agents have access to the shell (via bash, gh, git) and the filesystem.
Sanitization: No filtering or escaping is applied to the PR metadata or diff content.
[COMMAND_EXECUTION]: The skill uses various shell commands (gh, git, bash, find) to gather data and verify file duplication. When combined with the permission bypass and untrusted input from PRs, this increases the risk of arbitrary command execution.

cc-pr-review