The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically references and depends on scripts from an external html-report skill located at relative paths or within the user's home directory.
Evidence: SKILL.md states that build and publish scripts live at /../html-report/scripts/ and if missing, the agent should search ~/.claude/skills/html-report and ~/.agents/skills/html-report.
Risk: This mechanism involves dynamic loading from computed paths, which allows for the execution of external code that could be manipulated if an attacker gains access to these predictable local directories.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, including titles, bodies, diffs, and comments, which are used to generate reports and brief sub-agents.
Ingestion points: Workflow Step 2 in SKILL.md uses gh pr view to fetch PR bodies and comments, while references/review-brief.md instructs sub-agents to read the PR body and threads.
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the agent or sub-agents when processing this external content.
Capability inventory: The skill possesses significant capabilities including shell command execution via the GitHub (gh) CLI and the ability to spawn sub-agents.
Sanitization: There is no evidence of sanitization or filtering of pull request content before it is interpolated into agent instructions.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via the gh CLI to perform its core functions.
Evidence: Numerous instances in SKILL.md and references/review-brief.md describe the use of gh search prs, gh pr view, and gh pr diff. While expected for a PR management tool, this represents a significant attack surface if input is not properly handled.

pr-report