The Agent Skills Directory

[COMMAND_EXECUTION]: The skill suggests running test suites like npm test or pytest on code changes from external pull requests.
Evidence: npm test -- --coverage --changedSince=main and pytest --cov --cov-report=term-missing in SKILL.md.
Security Concern: Executing tests on untrusted code from a PR allows for potential remote code execution if the PR contains malicious logic within its test files.
[CREDENTIALS_UNSAFE]: The skill requires and manages sensitive API tokens for Jira and Linear services.
Evidence: Reference to JIRA_API_TOKEN and LINEAR_API_KEY in the Ticket Linking Verification section.
Security Concern: Although the skill provides advice on minimizing exposure in process lists (using stdin redirection for curl), the requirement for these tokens in the execution environment poses a credential management risk.
[DATA_EXFILTRATION]: The skill performs network requests to external services to fetch ticket information.
Evidence: curl commands targeting your-org.atlassian.net and api.linear.app.
Security Concern: While these are well-known services, the pattern involves sending data (ticket IDs and authentication headers) to external endpoints.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted code diffs and PR descriptions.
Ingestion points: PR diffs are fetched via gh pr diff and stored in /tmp/pr-$PR.diff.
Boundary markers: No explicit boundary markers or instructions to treat diff content as untrusted data are present.
Capability inventory: The agent has the ability to execute shell commands, read/write files, and make network requests.
Sanitization: No sanitization or filtering of the PR content is performed before the agent analyzes it, creating a surface where malicious instructions embedded in a PR could influence agent behavior.

pr-review-expert