The Agent Skills Directory

[COMMAND_EXECUTION]: The skill grants the external AI model the capability to execute arbitrary shell commands on the local system. This is specifically enabled in reviewer-prompts/claude.md where the claude CLI is invoked with the --tools "Read,Bash" and --dangerously-skip-permissions flags, bypassing standard permission checks for scripted use.
[REMOTE_CODE_EXECUTION]: In reviewer-prompts/gemini.md, the gemini CLI is executed with the --yolo flag. This configuration forces the automatic approval of all tool calls requested by the AI model, allowing it to perform shell operations or read files without any interactive oversight from the user.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from the git repository—specifically the branch diff ($DIFF) and commit history ($COMMIT_LOG)—and includes this content in the prompts sent to the external reviewers. There are no robust boundary markers or instructions to ignore embedded commands, meaning a malicious developer could craft a code comment that tricks the reviewer into executing system commands or exfiltrating data.
[DATA_EXFILTRATION]: Because the AI reviewers have access to both the repository files (via the Read tool or git commands) and the shell (via the Bash tool), an injection attack could lead to the theft of sensitive information. A compromised reviewer could be instructed to read environment variables, SSH keys, or cloud credentials and transmit them to an external server or include them in the visible review report.
[EXTERNAL_DOWNLOADS]: The skill communicates with external services from well-known technology providers, including Anthropic, Google, and OpenAI. It transmits repository metadata, file contents, and code diffs to these platforms to perform the requested adversarial analysis.

pre-merge-review