The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from external PR comments and uses an LLM to interpret actions and content for file modifications.
Ingestion points: Reviewer feedback is collected from GitHub PR comments and issue comments (Step 3).
Boundary markers: None. The instructions do not specify the use of delimiters or warnings to ignore potentially malicious instructions embedded within the feedback.
Capability inventory: The skill possesses the ability to modify the filesystem (updating JSON changesets and Markdown reports) and execute network operations (pushing commits to GitHub).
Sanitization: The skill implements an entry ID whitelist (Step 1) to restrict which records can be modified. However, the content of the updates (e.g., the "new claim" in Step 6) is interpreted from the comments without secondary validation or sanitization.
[COMMAND_EXECUTION]: Risk of Unsafe Command Interpolation. Steps 5 and 6 provide shell command templates (using jq) that interpolate variables derived from natural language feedback (<entry-id>, <new claim>, <reviewer reason>). If the agent executes these via a shell as literal strings rather than using parameterized tool calls, an attacker could attempt to manipulate the jq filter or the shell command structure.

curate-report