The Agent Skills Directory

[COMMAND_EXECUTION]: The execution pattern bash ~/.claude/scripts/classify-review-state.sh <PR番号> "$VERDICTS_JSON" <OWNER/REPO> uses user-provided arguments directly within a shell command template. This presents a potential command injection risk if the agent does not properly escape the <PR番号> input before execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection where untrusted data could influence agent behavior.
Ingestion points: External review comments are loaded from pending-review-comments.json (which mirrors GitHub data) into the raw_comments variable in SKILL.md.
Boundary markers: The instructions lack robust delimiters (such as XML tags or randomized separators) for the {raw_comments} interpolation, using only a markdown header ## コメント一覧 to separate data from instructions.
Capability inventory: The skill possesses Bash and Agent tools, allowing it to execute scripts and invoke subagents based on the content of external data.
Sanitization: There is no evidence of text sanitization or instruction-filtering for the PR comments before they are passed to the Haiku subagent, relying instead on a downstream validation script.
[DATA_EXFILTRATION]: The skill reads sensitive local state files containing PR review information from ~/.claude/state/pending-review-comments.json. While used for its primary purpose, this access to application-specific state files should be monitored to ensure data is not inadvertently exposed or modified outside of the intended workflow.

classify-review