The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill is configured to execute third-party tools at runtime using npx, specifically npx agent-reviews and npx agents install. These tools are downloaded and run from the npm registry without being pinned as local dependencies, which introduces a dependency on the integrity of the remote package and its source repository (e.g., github.com/pbakaus/agent-reviews).
[COMMAND_EXECUTION]: The skill utilizes specialized Node.js scripts in the scripts/user-acceptance/ directory to run arbitrary shell commands for software testing and verification (UAT). While these scripts are implemented with security in mind (using spawn with shell: false to mitigate shell injection), they grant the agent broad authority to execute code based on inputs derived from task descriptions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external platforms (Linear issues and GitHub PR comments) to drive its implementation and review logic.
Ingestion points: Data enters the agent's context through Linear tool calls (get_issue, list_comments) and the agent-reviews CLI.
Boundary markers: The prompt templates in references/implementer-prompt.md and references/spec-reviewer-prompt.md lack explicit instructions for the agent to disregard malicious or conflicting commands that might be embedded within the issue body or comments.
Capability inventory: The agent possesses capabilities to write to the filesystem, execute shell commands, and perform API writes to Linear and GitHub.
Sanitization: There is no evidence of specific sanitization or filtering applied to external content before it is interpolated into task instructions.
[EXTERNAL_DOWNLOADS]: The skill documentation explicitly instructs the agent to download and run external code via npx rather than vendoring dependencies, creating a runtime reliance on external repositories and package registries.

build