The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party data from several sources, creating a surface for indirect prompt injection attacks:
Ingestion points: Pull request bodies and titles are fetched in scripts/derivation/auto_detect.py and scripts/fetch_pr_meta.sh. GitHub issue bodies are retrieved in scripts/derivation/auto_detect.py. Project-specific instruction chains are loaded in scripts/scope.py and scripts/run_validators.py.
Boundary markers: The skill does not use specific delimiters or "ignore embedded instructions" warnings when interpolating these untrusted strings into prompts for the axis subagents in scripts/axis_dispatch.py or validators in scripts/run_validators.py.
Capability inventory: The skill possesses significant capabilities, including shell command execution (Bash tool) used for running the analyzer battery (scripts/run_battery.sh) and build verification (scripts/run_build_verify.py).
Sanitization: Ingested content from planning artifacts and PR metadata is not sanitized or filtered before being passed to LLM subagents.
[COMMAND_EXECUTION]: The skill relies on executing various external analyzers and project-defined scripts:
The analyzer battery in scripts/run_battery.sh executes project-local binaries found in node_modules/.bin and binaries available on the system PATH (such as knip, jscpd, vulture, semgrep).
The --verify-build feature in scripts/run_build_verify.py detects and runs the repository's canonical test command (e.g., npm test, pytest, cargo test).
The --mutation-test functionality in scripts/run_mutation.py executes mutation testing frameworks like Stryker, mutmut, and Pitest using the project's build system (Maven, Gradle, etc.).
While the skill includes safety advice to run reviews of untrusted checkouts in a sandbox and uses OFFLINE environment variables to restrict network access, the execution of repository-defined scripts remains a standard supply chain risk factor.

code-ultrareview