The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax in SKILL.md to execute shell commands (git rev-parse, gh pr view, gh api) when the skill is loaded. This dynamically populates the agent's prompt with repository state and CodeRabbit feedback. Fetching untrusted content from the GitHub API directly into the context at load time increases the attack surface for prompt-based exploits.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests external data from CodeRabbit review comments and PR bodies. An attacker who can influence these comments (e.g., by triggering specific CodeRabbit feedback through PR content) could craft instructions that the agent might follow, such as 'ignore safety rules' or 'delete the repository'.
Ingestion points: Found in SKILL.md within the <coderabbit_review> and <coderabbit_comments> tags, which are populated via gh CLI commands.
Boundary markers: The untrusted data is wrapped in XML-style tags, but the instructions in Step 1 explicitly tell the agent to 'Extract actionable comments', which effectively crosses the boundary.
Capability inventory: The skill possesses high-privilege capabilities including Edit (to modify source code), Task (to spawn subagents), and Bash (to run gh api and pnpm commands).
Sanitization: No explicit sanitization or validation of the remote comment content is performed before the agent processes it.
[COMMAND_EXECUTION]: The skill utilizes several powerful CLI tools, including gh (GitHub CLI), git, and pnpm. It specifically uses gh api to post replies to PR comments and pnpm to run build-time checks. These commands are executed with the user's environment privileges.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from GitHub's official API. While GitHub is a well-known service, the data fetched (PR comments) is user-generated and untrusted.

review-coderabbit