The Agent Skills Directory

[COMMAND_EXECUTION]: The provided example for webhook-handler.js contains a critical command injection vulnerability. It directly interpolates the event.comment.body (untrusted user input from GitHub comments) into a shell command executed via execSync without any sanitization or escaping. An attacker could craft a PR comment to execute arbitrary shell commands on the server running the webhook.
[EXTERNAL_DOWNLOADS]: The skill makes extensive use of npx ruv-swarm. The npx utility downloads and executes code directly from the NPM registry. The ruv-swarm package is not from a verified or well-known service, posing a significant risk of remote code execution if the package or the registry is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub pull requests, creating a high-risk surface for indirect prompt injection.
Ingestion points: Data enters the agent context via gh pr view, gh pr diff, and by parsing PR comments for swarm commands.
Boundary markers: The skill lacks explicit boundary markers or "ignore embedded instructions" warnings when passing PR data to the underlying swarm agents.
Capability inventory: The skill possesses capabilities to modify PRs (comment, label, review), execute network-based CLI tools, and run arbitrary JavaScript via npx.
Sanitization: There is no evidence of sanitization or filtering of the ingested PR data before it is processed by the AI agents or passed to shell commands.
[DYNAMIC_EXECUTION]: The register-agent functionality allows the skill to load and execute arbitrary JavaScript files from local paths (--file "./custom-review-agent.js"). If an attacker can place a malicious file on the file system, this provides a mechanism for local code execution.

github-code-review