The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (e.g., git diff, git log) using a user-supplied <base> argument without any validation or sanitization. This allows for arbitrary shell command injection if a malicious string containing command separators (like ;, &&, or |) is provided as the branch name.
Evidence: SKILL.md defines commands such as git diff --stat <base>...HEAD and git log <base>..HEAD --oneline.
[COMMAND_EXECUTION]: The skill allows a user-controlled --out argument to specify the file path for the generated report. Without path validation, this could be used to perform path traversal or overwrite sensitive system files.
Evidence: SKILL.md defines the argument --out <path> for the output destination.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the repository's history (commit messages) and file diffs to 'extract review points' and generate summaries. Malicious instructions hidden in these data sources could influence the agent's behavior.
Ingestion points: Output of git log and git diff commands.
Boundary markers: None present; the skill does not use delimiters to isolate untrusted data.
Capability inventory: The skill has instructions to execute shell commands and write to the file system.
Sanitization: No sanitization or instruction filtering is applied to the ingested repository data.

pr-brief