The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute npm run preflight immediately after checking out a remote Pull Request using gh pr checkout. This creates a significant risk because a malicious Pull Request author could modify the package.json file to include harmful code in the preflight script, which would then be executed with the agent's permissions.
[COMMAND_EXECUTION]: The skill relies on shell commands for its core functionality, including gh, npm, and git. While these are standard tools, their automated use on external content increases the attack surface.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from Pull Request descriptions, comments, and code changes.
Ingestion points: The agent reads the PR description, comments, and file diffs (SKILL.md Step 2 & 3).
Boundary markers: There are no instructions provided to the agent to treat external PR content as data or to ignore embedded instructions within that content.
Capability inventory: The agent has the ability to execute shell commands (npm, gh, git) and write to the local file system (SKILL.md Step 2).
Sanitization: No sanitization or validation of the PR content is performed before the agent processes it for analysis.

code-reviewer