The Agent Skills Directory

[COMMAND_EXECUTION]: In Step 11 ('Post-fix verification'), the skill identifies and executes shell commands defined in project configuration files such as package.json, Makefile, composer.json, and Rakefile. Since these files are controlled by the author of the pull request being reviewed, a malicious actor could include scripts that perform destructive actions or exfiltrate sensitive data when the agent attempts to run tests or linters.
[REMOTE_CODE_EXECUTION]: The automated execution of scripts sourced from an untrusted repository diff constitutes a remote code execution vector. The agent is instructed to run test commands found within the codebase without prior validation, filtering, or sandboxing.
[DYNAMIC_EXECUTION]: The skill dynamically determines and executes bash commands based on the content of untrusted project files at runtime, which is a significant security risk when those files are under the control of a potentially adversarial user.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository and uses it to guide its own logic and that of subagents.
Ingestion points: The skill reads git diff output, gh pr view output, TODOS.md, DESIGN.md, and project configuration files throughout the workflow (SKILL.md, Step 3, Step 6, Step 8).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or isolate potentially malicious instructions embedded within the PR description or code diffs.
Capability inventory: The skill has access to the Bash tool for command execution, Write/Edit tools for file modification, and the Agent tool for dispatching subagents, all of which could be abused via malicious input.
Sanitization: No sanitization, escaping, or validation is performed on the data retrieved from the PR before it is interpolated into prompts or used in command execution.

review