The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 3) direct the agent to execute various shell commands such as pytest, npm test, cargo test, mypy, and eslint. This capability is used to automate the verification of code against acceptance criteria.
[REMOTE_CODE_EXECUTION]: By design, the skill executes the project's own test suite. If the code being reviewed is malicious (e.g., a PR from an external attacker), running commands like npm test or pytest can result in the execution of arbitrary, harmful code embedded in the project's tests or build scripts.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes untrusted data from external files.
Ingestion points: In Step 1 of SKILL.md, the agent is instructed to read REQUEST.md, PLAN.md, PR descriptions, and linked issues.
Boundary markers: The instructions do not define delimiters or provide specific warnings to the agent to ignore potentially malicious instructions embedded within these external documents.
Capability inventory: The agent has the capability to execute shell commands (SKILL.md Step 3) and perform file system operations (SKILL.md Step 5 and 7).
Sanitization: No sanitization, escaping, or validation steps are performed on the content of the ingested files before they are processed by the agent.

intent-based-review