The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to automatically detect and execute a RUN_COMMAND (e.g., from package.json, Makefile, or docker-compose.yml) found within the repository being reviewed. This behavior involves executing potentially untrusted shell commands or scripts at runtime to perform behavior-based QA.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from several external sources to build prompts for sub-agents.
Ingestion points: Data is pulled from git diff, git log, full file contents, GitHub issues/PRs, and communication channels like Slack, Notion, and Discord (SKILL.md).
Boundary markers: The skill uses XML-like delimiters such as <file_contents>, <diff>, and <original_goal> to separate data from instructions.
Capability inventory: The agent can spawn sub-agents, execute shell commands (git, gh, and detected build scripts), and control browsers (playwright, dev-browser).
Sanitization: The skill lacks explicit sanitization or filtering for the external content it interpolates into sub-agent prompts, relying entirely on the delimiters to prevent the agent from following embedded instructions.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic execution patterns by determining the application's startup command from the local file system and executing it in a sub-agent environment to verify behavior. This presents a risk if the codebase under review contains malicious instructions in its build or startup scripts.

review-work