The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell command templates that use environment variables like $REPO, $SCOPE, and $PROMPT. If an agent interpolates unsanitized user input into these variables before executing the shell command, it could lead to arbitrary command execution on the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and review untrusted artifacts from a code repository, including file paths, excerpts, and diffs. This data is provided to the GLM model as part of a review brief, creating a surface for indirect prompt injection attacks where malicious instructions hidden in the code could attempt to influence the model or the agent.
Ingestion points: Contents of files in the $REPO directory, relevant code excerpts, and repository diffs included in the review brief.
Boundary markers: The instructions mandate including a verbatim boundary string in the brief: Read-only review. Do not edit files or run state-changing commands.
Capability inventory: The skill uses opencode run (which can invoke agents and tools), grep, and opencode auth list to check credentials.
Sanitization: There are no explicit instructions for escaping or sanitizing the content interpolated into the brief to prevent the LLM from obeying instructions embedded in the artifacts.
[DYNAMIC_EXECUTION]: The skill instructs the agent to generate and execute a Python script using subprocess.Popen with specific parameters (like start_new_session=True and stdin=DEVNULL) to handle process execution, timeouts, and signal management more effectively than a standard shell command.

glm-review