The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_spec.py uses subprocess.run(shell=True) through a wrapper function run_command to execute gh and git commands.
Vulnerable URL Parsing: In parse_pr_url, the regular expression github\.com/([^/]+)/([^/]+)/pull/(\d+) extracts the owner and repository name using a character class ([^/]+) that allows shell metacharacters like ;, &, |, and backticks.
Injection in PR View: The extracted owner and repo are interpolated directly into a shell command string in fetch_pr_info: f'gh pr view {pr_number} --repo {owner}/{repo} ...'. A URL like github.com/owner;whoami/repo/pull/1 would cause the shell to execute whoami.
Injection via PR Metadata: Branch names retrieved from the GitHub API (baseRefName and headRefName) are used directly in shell commands within get_git_diff and resolve_branch_ref. Specifically, run_command(f"git fetch origin {base_branch}:{base_branch}", ...) will execute arbitrary commands if a branch name contains shell metacharacters (e.g., ; rm -rf /).
Missing Sanitization: There is no evidence of shell escaping (e.g., using shlex.quote) or the use of argument lists instead of raw shell strings, which is the primary cause of these vulnerabilities.

pr-tech-spec-generator