The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands (e.g., agent, gh, git) using variables derived from user input () and runtime discovery (). Specifically, Step 3 in SKILL.md executes agent -p --model --mode plan "Review ...". The absence of explicit sanitization or quoting instructions for these variables poses a risk of command injection if a user provides shell metacharacters (e.g., semicolons or pipes) in the input identifier.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub PR titles, bodies, and diffs using gh and git commands (Step 0) and passes this data to a secondary LLM via the agent CLI (Step 3). The instructions lack boundary markers (e.g., XML tags or delimiters) or explicit warnings to ignore instructions found within the PR content, potentially allowing a malicious PR to subvert the review process or influence the agent's actions. * Ingestion points: PR metadata and diff content are retrieved via gh pr view, gh pr diff, and git diff (SKILL.md, Step 0). * Boundary markers: No delimiters or safety instructions are included in the prompt template for the secondary review (SKILL.md, Step 3). * Capability inventory: The skill can execute shell commands (gh, git), spawn other agents (agent, codex, claude), and write comments to GitHub (SKILL.md, Step 2, 3, 6). * Sanitization: No escaping or validation of external PR content is performed before interpolation into the review prompt.

cross-model-review