The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of external dependencies via npx skills add. While it fetches components from trusted organizations like Vercel Labs and well-known services like Sentry, it also directs the user to install a skill from an unverified personal repository (github.com/ramziddin/solid-skills).
[DATA_EXFILTRATION]: The skill accesses sensitive local and external information to build a context bundle. This includes GitHub PR body and comments, Linear issue details and comments, and the user's local development history from devsql (including previous Claude Code sessions). This data is exposed to the agent context for analysis.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests and processes data from external platforms (GitHub and Linear) that are controlled by potentially untrusted parties. Malicious content in a PR comment or issue description could manipulate the agent's behavior during the review or automated fix phases.
Ingestion points: External data is retrieved using gh pr view and linear-cli in Step 3g.
Boundary markers: The prompt structure uses simple Markdown headers for organization but does not include explicit instructions to the sub-agents to ignore or isolate embedded instructions within that data.
Capability inventory: The skill has significant capabilities, including modifying project files using the Edit tool (via the --fix flag) and spawning autonomous sub-agents.
Sanitization: No sanitization or filtering logic is applied to the ingested external content before it is passed to the sub-agents.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution to manage its internal state, calculate cache keys using shasum and git diff, and verify the presence of dependencies in the local filesystem. It also orchestrates a multi-agent team to perform specialized code reviews.

gate