The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions require the agent to use 'dangerouslyDisableSandbox=true' when running the 'glm-review' command. This bypasses the agent's security isolation and allows the process full access to the user's filesystem and environment.
[EXTERNAL_DOWNLOADS]: The skill depends on 'glm-review', an external package installed via npm. Running unverified third-party binaries, particularly with the sandbox disabled, increases the risk of system compromise.
[CREDENTIALS_UNSAFE]: The documentation identifies the specific filesystem path for API credentials ('~/.claude/.env.local'). This information could be used by a malicious actor or a compromised tool to target and exfiltrate sensitive keys.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted code changes without sanitization. * Ingestion points: Output from 'git diff' and 'git show' commands. * Boundary markers: No delimiters or protective instructions are provided to separate code content from instructions. * Capability inventory: The agent has access to 'Bash', 'Read', and 'Edit' tools, which could be misused if malicious instructions are found in a diff. * Sanitization: There is no automated sanitization of the input data, although the skill instructs the agent to perform manual verification of the model's output.

rr