The Agent Skills Directory

[COMMAND_EXECUTION]: The reference documentation (references/reference.md) provides an implementation example for a webhook handler that uses execSync to process pull request comments. The example directly interpolates the user-provided comment body into a shell command string, which is a significant command injection vulnerability.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub pull requests, creating a surface for potential indirect prompt injection attacks where malicious code or instructions in a PR could influence the agent's behavior.\n
Ingestion points: The skill fetches pull request titles, bodies, and diffs using the gh CLI in SKILL.md and references/reference.md.\n
Boundary markers: There are no boundary markers or explicit instructions to the review agents to ignore potentially malicious embedded content in the ingested PR data.\n
Capability inventory: The skill can execute shell commands (Bash), perform PR management operations (gh pr merge), and install external packages via npx.\n
Sanitization: No sanitization or filtering logic is present for the ingested PR content before it is passed to the AI agents for analysis.\n- [DYNAMIC_EXECUTION]: The skill documentation describes a feature to register custom review agents from local JavaScript files via the register-agent command. Dynamically loading and executing arbitrary script files at runtime is a high-risk code execution pattern.\n- [EXTERNAL_DOWNLOADS]: The skill frequently uses npx to download and run the ruv-swarm and claude-flow packages. Although these appear to be vendor-associated resources, the use of npx for runtime execution introduces a dependency on external code registries without fixed versioning or integrity checks in the skill metadata.

github-code-review