The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various git and GitHub CLI commands (git diff, git show, gh pr diff) to retrieve repository data for the recap. It also uses the open command to launch the generated HTML report in the user's browser.
[EXTERNAL_DOWNLOADS]: The documentation suggests using bunx critique --web --open, which downloads and executes the critique package from the npm registry. While described as part of the author's toolset, this involves remote code retrieval and execution at runtime.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from repository diffs and interpolates it into an HTML template for review.
Ingestion points: Git diff outputs and PR descriptions retrieved via git diff, git show, and gh pr diff (SKILL.md).
Boundary markers: There are no explicit instructions to use boundary markers or delimiters when inserting diff content into the HTML template to prevent the execution of malicious embedded instructions or scripts.
Capability inventory: The skill can execute shell commands (git, gh, open) and generates HTML files containing JavaScript (SKILL.md, assets/template.html).
Sanitization: While the skill explicitly instructs the agent to redact secrets (like API keys), it lacks instructions for HTML escaping or content sanitization. Malicious HTML or JavaScript contained within a code diff could be rendered in the reviewer's browser, leading to XSS.

visual-review