The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request diffs and metadata using 'gh' and 'glab' CLI tools. This data is then processed to perform security and quality analysis, creating an attack surface where instructions embedded in a PR could influence agent behavior.
Ingestion points: Pull request diffs and metadata fetched via 'gh pr diff', 'gh pr view', 'glab mr diff', and 'glab mr view' (SKILL.md).
Boundary markers: No delimiters or specific instructions are provided to the agent to treat the ingested diff content as untrusted data or to ignore instructions embedded within it.
Capability inventory: The agent has access to shell command execution (grep, npm, pytest, curl), network operations via curl with API tokens, and file system access to /tmp.
Sanitization: There is no evidence of sanitization or escaping of the diff content before it is processed by the agent's logic.
[COMMAND_EXECUTION]: Step 4 of the workflow instructs the agent to run 'npm test' and 'pytest'. These commands execute code defined in the repository (such as package.json scripts or test files), which may have been modified in the pull request currently being reviewed.
[DYNAMIC_EXECUTION]: By running test coverage checks on untrusted branches, the skill executes code that is part of the PR's input. Maliciously crafted tests or build configurations (e.g., hooks in package.json or conftest.py) could lead to arbitrary code execution within the agent's environment during the review process.

pr-review-expert