The Agent Skills Directory

[COMMAND_EXECUTION]: The skill accepts a PR number as input and interpolates it directly into shell commands throughout the file, such as gh pr view $ARGUMENTS. This allows for command injection if an actor provides an argument containing shell metacharacters like semicolons or backticks.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses backtick-enclosed shell commands in the header context which are executed automatically when the skill is loaded. These commands incorporate the unsanitized $ARGUMENTS variable, enabling silent command execution on the host machine at the moment the skill is initialized.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from GitHub Pull Requests, including titles, bodies, and comments. It lacks necessary boundary markers or instructions to treat this content as data only, which could allow a malicious PR to override the agent's instructions. 1. Ingestion points: PR metadata, bot comments, and file patches fetched via GitHub API. 2. Boundary markers: None identified; untrusted data is injected directly into the agent's context. 3. Capability inventory: The skill has access to the Bash tool and the GitHub CLI (gh), which can be used to modify repository settings or enable workflows. 4. Sanitization: No evidence of escaping or filtering for the external PR content.
[PRIVILEGE_ESCALATION]: The skill attempts to programmatically enable GitHub Actions workflows via the GitHub API. This is a sensitive operation that requires elevated permissions and could be abused if the initial security assessment is bypassed or manipulated.

contrib-pr-review