The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (the ! syntax) to execute shell commands like gh pr view $ARGUMENTS and gh pr diff $ARGUMENTS when the skill is loaded. The $ARGUMENTS variable, which contains user-supplied input, is interpolated directly into these shell commands without sanitization or validation. This allows a malicious user to perform command injection (e.g., by providing an argument like 123; malicious_command) to execute arbitrary code in the agent's execution environment.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically the title, body, diff, and comments of pull requests on the denoland/deno repository. This data is provided by PR authors and commenters who may embed malicious instructions to manipulate the agent's behavior during the review process.
Ingestion points: PR metadata (title, body), file diffs, and community comments fetched via gh pr view and gh pr diff in SKILL.md.
Boundary markers: None. The instructions do not provide delimiters or warnings to help the agent distinguish between PR content and the skill's operational instructions.
Capability inventory: The skill has access to powerful tools including the GitHub CLI (gh), git, and file system tools (Read, Glob, Grep). It is explicitly instructed to post reviews and comments to GitHub using gh api and gh pr review.
Sanitization: No sanitization, filtering, or validation is performed on the PR content before it is processed by the agent. The agent is instructed to "Read every changed file" and "follow the relevant spec," which increases the risk of following instructions hidden in code comments or PR descriptions.

review-pr