The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to automatically resolve environmental blockers by executing installation commands for dependencies found in the repository under review.
Evidence: In references/preflight.md, the 'Blocked preflight' section instructs the agent to 'Fix it and continue' when dependencies are missing, stating: 'Read-only skills (audit, review, spec, docs, release) may install dependencies and correct the command they invoke.'
Risk: This mandates that the agent run package managers like npm, pip, or cargo on untrusted codebases before the security review has even started.
[REMOTE_CODE_EXECUTION]: The instruction to automatically install dependencies from untrusted sources creates a direct path for remote code execution.
Risk: An attacker can include malicious scripts in manifest files (e.g., a 'postinstall' script in 'package.json' or executable logic in 'setup.py'). When the agent attempts to 'unblock' the environment by installing these dependencies as instructed, the malicious code executes with the agent's privileges on the host system.
[PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted external content (source code and diffs), establishing an indirect prompt injection surface.
Ingestion points: Git diffs, pull request content, and project source files (referenced in SKILL.md and references/preflight.md).
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore instructions embedded within the reviewed code.
Capability inventory: The skill spawns subagents, writes findings to the local filesystem (under .nuke/), and executes shell-based 'gate' commands for testing and linting.
Sanitization: No sanitization or filtering of the external code content is mentioned before it is passed to the auditor subagents.

nuke-review