The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/bootstrap.ts script automatically executes bun install --frozen-lockfile during the first run. This process attempts to fetch packages from external registries. The package.json and bun.lock files specify several non-existent and suspicious versions of well-known packages, including commander@14.0.0, typescript@7.0.2, and bun-types@1.3.14. At the time of analysis, these versions do not exist on the public NPM registry, which is a common indicator of a supply chain attack preparation or dependency confusion attempt.
[REMOTE_CODE_EXECUTION]: By triggering an installation of unverifiable and potentially malicious packages via bun install, the skill facilitates the execution of remote code during the dependency installation phase (via post-install scripts) or when the packages are subsequently loaded.
[COMMAND_EXECUTION]: The bootstrap script uses Bun.spawnSync to execute shell commands for installing dependencies and then restarts the process. If a malicious package is successfully installed, this mechanism would directly execute the compromised code.
[DYNAMIC_EXECUTION]: The scripts/bootstrap.ts script contains logic to self-restart the process using Bun.spawnSync([process.execPath, ...process.argv.slice(1)], ...) after dependencies are installed. This dynamic execution flow is used to transition from the installation phase to the main script execution, but it also serves as the trigger for the code delivered by the suspicious dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading PR comments and review threads which are external, attacker-controllable data sources. While the SKILL.md instructions correctly identify this risk and advise the agent to treat comment text as untrusted and avoid interpolation into shell commands, the ingestion of this data still presents an inherent surface for indirect prompt injection attacks.

babysit