The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation guide includes a command that downloads a script from the author's GitHub repository and pipes it directly to the bash shell for execution (curl -sSfL ... | bash). This is a standard installation method for CLI tools when sourcing from a known vendor.
[PRIVILEGE_ESCALATION]: The skill provides instructions for building from source which involves using sudo to move the resulting binary to /usr/local/bin/, a protected system directory. This requires administrative privileges for the final step of installation.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and retrieve code review comments from external sources like GitHub. As this data is processed and presented to the agent, it represents an indirect prompt injection surface.
Ingestion points: Comments are fetched from GitHub repositories via the gh CLI or imported from local JSON files into a SQLite database (reviews.db).
Boundary markers: The instructions do not specify explicit delimiters for the retrieved comment text when presented to the LLM.
Capability inventory: The skill performs file system operations, network requests to GitHub, and local shell command execution.
Sanitization: The tool retrieves raw comment data for analysis; no specific sanitization routines for the content of the retrieved comments were identified.
[EXTERNAL_DOWNLOADS]: The skill fetches the fastembed Python package from a public registry and clones the project source code from GitHub during the optional build process.
[COMMAND_EXECUTION]: The setup process involves manipulating the PATH environment variable to include a local virtual environment for Python-based embedding tasks.

review-lens