The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md explicitly tell the agent to run commands found in the repository's AGENTS.md file for local checks. Since the content of this file is controlled by the repository being reviewed, an attacker could include malicious shell commands that the agent would then execute on the host machine.
[REMOTE_CODE_EXECUTION]: Because the commands to be executed are sourced from an external pull request or repository, this pattern functions as remote code execution, where untrusted code from a remote source is executed locally.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it ingests and processes untrusted data from multiple sources without adequate sanitization or boundary markers.
Ingestion points: The agent reads pull request metadata, descriptions, linked issues, earlier review comments, and the contents of the files being reviewed (SKILL.md, section 1 and 2).
Boundary markers: There are no instructions to the agent to disregard or escape instructions embedded within the pull request body or comments.
Capability inventory: The agent is authorized to execute shell commands (gh, git) and interact with the GitHub API to post reviews and comments (GITHUB.md).
Sanitization: No sanitization or validation logic is present to ensure that the content read from the pull request does not manipulate the agent's logic or the commands it executes.

review-walkthrough