The Agent Skills Directory

[COMMAND_EXECUTION]: The shell scripts provided for the orchestrator to execute contain command injection vulnerabilities due to unquoted variable expansion.
Evidence: In stages/00-context/CONTEXT.md and stages/02-post/CONTEXT.md, variables $PR and $REPO are used without quotes in commands such as gh pr view $PR --repo $REPO and gh pr comment $PR --repo $REPO. A malicious input for these parameters could terminate the intended command and execute arbitrary shell instructions in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from pull requests, creating a surface for indirect prompt injection where adversarial instructions could influence the review subagent.
Ingestion points: PR metadata, body, comments, and the repository's CLAUDE.md file are fetched in stages/00-context/CONTEXT.md and passed to the analysis stage.
Boundary markers: The subagent instructions in stages/01-cohesive-review/CONTEXT.md do not include protective delimiters or specific safety instructions to disregard instructions embedded within the PR diff, comments, or body content.
Capability inventory: The skill possesses the ability to interact with GitHub APIs to post comments and update labels based on the subagent's analysis.
Sanitization: Untrusted content fetched from the pull request is not sanitized, escaped, or filtered before being presented to the subagent for review.
[EXTERNAL_DOWNLOADS]: The skill fetches data and configuration from external GitHub repositories using the gh tool.
Evidence: stages/00-context/CONTEXT.md uses gh api and gh pr diff to retrieve content from the target repository, which is a well-known service but can host untrusted user content.

review-pr