The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The references/live-testing.md file describes an optional phase where the agent may run npx -y <pkg> --help or npm install on third-party packages. This involves downloading and executing code from external registries, which could trigger malicious install scripts.
[COMMAND_EXECUTION]: The skill instructions involve executing shell commands using gh (GitHub CLI) and curl. These tools are used to fetch pull request data, compare diffs, and interact with external APIs.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch configuration and reference documents from the vendor's official GitHub repository (raw.githubusercontent.com/base/skills/...).
[PROMPT_INJECTION]: The skill processes untrusted input from pull request bodies and plugin files, creating a surface for indirect prompt injection attacks.
Ingestion points: Pull request metadata and file content are read using gh pr view, gh pr diff, and the GitHub API in SKILL.md.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided when processing external content.
Capability inventory: The agent can execute shell commands (curl, gh, npx), post comments to GitHub, and perform network operations.
Sanitization: There is no evidence of sanitization or structural validation applied to the external content before processing.

plugin-review