The Agent Skills Directory

[COMMAND_EXECUTION]: The provided webhook-handler.js code example is vulnerable to shell command injection. It uses execSync to run a command that includes the unsanitized body of a GitHub comment (event.comment.body). An attacker could trigger this by posting a comment starting with /swarm followed by shell metacharacters and malicious commands (e.g., ; rm -rf /) to execute arbitrary code on the server.
[PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull requests (diffs, titles, and descriptions) and passes it to AI agents capable of performing actions like approving PRs or requesting changes. There are no boundary markers or sanitization steps to prevent indirect prompt injection, which could allow an attacker to embed instructions in a PR that subvert the intended review process.
Ingestion points: Pull request metadata (PR_DATA), code changes (PR_DIFF), and issue comments.
Boundary markers: None present in the orchestration scripts or automation templates.
Capability inventory: Access to the GitHub CLI (gh) for performing PR reviews, merges, and label modifications.
Sanitization: No sanitization or escaping of external content is performed before processing.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute ruv-swarm at runtime. This package originates from a source that is not a well-known service or trusted organization, posing a supply chain risk as it executes with the same privileges and access tokens as the agent.

github-code-review