The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to read authentication tokens from the local configuration file located at ~/.config/argos-ci/config.json.
[COMMAND_EXECUTION]: The skill executes shell commands via the argos CLI, such as argos build get and argos build review, using authentication tokens passed as environment variables or command-line flags.
[DATA_EXFILTRATION]: The skill ingests and displays external image URLs (e.g., head.url, base.url) from the Argos API, which represents a potential vector for out-of-band data exfiltration if the source data is manipulated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted information from pull request titles, descriptions, and commit messages to determine its review logic. * Ingestion points: Pull request title, description, branch names, commit messages, and metadata fields in SKILL.md. * Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions embedded within the ingested data. * Capability inventory: The skill has the capability to execute shell commands via the argos CLI. * Sanitization: There is no mention of sanitizing or validating the untrusted input before it is processed by the agent.

argos-pr-review