The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The GitLab CI template (templates/gitlab-ci-review.yml) fetches and executes an installation script from Anthropic's official domain.
Evidence: curl -fsSL https://claude.ai/install.sh | bash in the before_script section of the GitLab template.
[INDIRECT_PROMPT_INJECTION]: The skill's CI reviewer is designed to ingest and process untrusted data from pull request bodies, commit messages, and repository files, which could be used to influence the agent's behavior.
Ingestion points: PR/MR body, commit messages, DO.md, and repository code (specifically SKILL.md, references/, and CLAUDE.md) are read into the agent's context in prompts/review.md.
Boundary markers: The system prompt in prompts/review.md includes instructions for the agent to act as a reviewer and notes that its output is processed by a deterministic gate, but it does not utilize strict delimiters for the untrusted input text.
Capability inventory: The agent is granted Bash, Read, Grep, and Glob tools in the CI environment.
Sanitization: There is no evidence of sanitization or escaping of the external content before it is interpolated into the agent's instructions.
[COMMAND_EXECUTION]: The CI reviewer is instructed to execute arbitrary commands to verify claims made in code changes, creating a vulnerability if a malicious PR contains dangerous instructions disguised as verification steps.
Evidence: prompts/review.md directs the agent to "verify every claim... personally reproduce: run that test, execute that script, open that artifact."

ci-review