The Agent Skills Directory

[COMMAND_EXECUTION]: The webhook-handler.js example demonstrates a critical command injection vulnerability. It uses execSync to run shell commands where the pull request comment (event.comment.body) is directly interpolated into the command string. An attacker can execute arbitrary shell commands on the host system by posting a pull request comment containing shell metacharacters.\n- [EXTERNAL_DOWNLOADS]: The skill relies on npx ruv-swarm to execute its primary logic. This downloads and executes code from an external, third-party npm package at runtime, introducing a supply chain risk as the source is not a recognized trusted vendor.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from GitHub pull requests (diffs, titles, and comments) without sanitization or clear boundary isolation.\n
Ingestion points: Pull request content and comments are ingested via gh pr view and gh pr diff and passed as arguments to analysis agents.\n
Boundary markers: The instructions do not define delimiters or specific 'ignore embedded instructions' directives to isolate the untrusted code diffs from the agent's task instructions.\n
Capability inventory: The agents can perform powerful actions including posting reviews, modifying labels, and executing shell commands, which increases the potential impact of a successful prompt injection.\n
Sanitization: There is no evidence of sanitization or validation performed on the PR data before it is processed by the AI agents.

github-code-review