The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implementation uses child_process.execSync to run shell commands constructed via string interpolation of user-supplied variables. Parameters like branch and repoPath are directly embedded into command strings in src/utils/commit-collector.ts and src/utils/batch-reviewer.ts, creating a command injection surface if the input is attacker-controlled.
[DATA_EXFILTRATION]: The skill constructs API request URLs based on user-provided repository links and fetches data using fetch. The parsing logic in src/analyzers/diff-parser.ts allows for arbitrary hostnames in GitLab-formatted URLs, which could lead to network operations targeting non-whitelisted or malicious domains.
[DYNAMIC_EXECUTION]: The skill spawns subprocesses to interact with the Git CLI for core functionality, including collecting commits, fetching file contents, and calculating diffs. This frequent use of child_process.execSync to execute external binaries based on external repository state increases the attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted code content from external repositories. While it uses a static engine, it lacks explicit boundary markers for the data it ingests (via git show and file reads), creating a surface where malicious code comments or identifiers could influence the agent's review output.

harmonyos-code-review