The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a potential shell injection vulnerability by passing the $ARGUMENTS variable directly to the shell in the gh pr view command. If the user-supplied arguments are not strictly validated by the platform, an attacker could execute arbitrary commands by including shell metacharacters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from pull request titles, bodies, and code diffs which are then processed by the agent to generate summaries and Mermaid diagrams.
Ingestion points: gh pr view and gh pr diff commands in SKILL.md retrieve attacker-controlled content from GitHub.
Boundary markers: The instructions do not define clear delimiters or use "ignore embedded instructions" guards when processing PR content.
Capability inventory: The skill utilizes Bash to run gh pr comment, giving the agent the ability to post attacker-influenced content back to GitHub or execute commands based on the injected instructions.
Sanitization: No sanitization or validation logic is defined for the content fetched from GitHub before it is used to construct the final output or influence agent logic.

pr-review-navigator