The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax to execute shell commands at load time. User-supplied input from $ARGUMENTS is directly interpolated into multiple gh CLI commands, such as gh pr view $ARGUMENTS. This creates a command injection vulnerability where a malicious argument containing shell metacharacters could execute arbitrary code on the system.
[COMMAND_EXECUTION]: The skill executes complex shell pipelines to assess test coverage by parsing content from modified files in a Pull Request. It extracts function and class names and passes them directly to subsequent shell commands like grep -r "$name" tests/. Since the PR content is untrusted external data, a contributor could craft a payload in a function name to trigger arbitrary command execution. Additionally, the skill attempts to modify repository settings by enabling GitHub Actions workflows.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external PRs which influences its execution flow and output.
Ingestion points: PR metadata, file names, and file contents are fetched via the GitHub API.
Boundary markers: No delimiters or isolation techniques are used for the processed external content.
Capability inventory: The skill utilizes shell execution and network access to interact with the repository.
Sanitization: Data extracted from PR files is not sanitized or escaped before being used in dynamic shell commands.

contrib-pr-review