The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically determines and executes shell commands for testing and linting based on configuration files found in the repository (e.g., package.json, Makefile, pyproject.toml).
Evidence: Step 5 of SKILL.md explicitly instructs the agent to execute commands like 'npm test', 'go test', and 'pytest' based on detected signals in the project root.
[REMOTE_CODE_EXECUTION]: The skill prioritizes and executes instructions found in a 'CLAUDE.md' file within the repository, allowing it to override default behaviors and execute arbitrary commands defined in the codebase.
Evidence: SKILL.md states that 'CLAUDE.md' may contain critical instructions that 'take precedence over any assumptions' regarding command execution, creating a direct vector for a malicious repository to execute code on the agent's host.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from GitHub issues and repository files and uses it to influence its actions and command generation.
Ingestion points: GitHub issue metadata, body, and comments via 'gh issue view'; repository files and PR diffs via 'git' and 'gh' CLI.
Boundary markers: No delimiters or instructions are provided to the agent to distinguish between its core instructions and the untrusted data it is processing.
Capability inventory: The agent has the capability to execute shell commands ('npm', 'pytest', etc.) and interact with GitHub APIs ('gh issue close/comment').
Sanitization: There is no evidence of sanitization, validation, or escaping of the content fetched from GitHub or the local repository before it is processed or used in shell commands.

review-issue