The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Claude Code's dynamic context injection feature (!) to execute shell commands when the skill is loaded. It insecurely incorporates the $ARGUMENTS variable, which contains user-provided input, into shell commands like git log and git diff via the set -- $ARGUMENTS` pattern. This allows a malicious user or a prompt-based attack to inject arbitrary shell commands (e.g., by using backticks, semicolons, or pipe characters) which will then be executed on the host system with the agent's privileges.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It ingests untrusted data in the form of repository diffs and file contents, which are then processed by subagents (sonnet).
Ingestion points: Repository diffs (git diff) and file contents are read into the context via shell commands.
Boundary markers: The instructions do not define clear delimiters or specific instructions for the subagents to ignore commands or instructions embedded within the reviewed code changes.
Capability inventory: The skill can spawn subagents to review code and run local test suites via package.json scripts.
Sanitization: There is no evidence of sanitization, escaping, or structural validation of the diff content before it is analyzed by subagents.

verify-no-regressions