The Agent Skills Directory

[COMMAND_EXECUTION]: The fix-verify logic in review.js explicitly instructs the agent to "Run the commands the new prose tells a reader to run." This creates a dangerous condition where a malicious pull request author can trigger the execution of arbitrary commands by including them in documentation, README files, or comments within the PR diff.
[REMOTE_CODE_EXECUTION]: The skill's "Probe" phase in SKILL.md directs the agent to execute check scripts found in the repository's package.json. Because these scripts are part of the code being reviewed, a malicious PR could modify them to execute unauthorized code on the host machine when the review is initiated.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection because it processes untrusted data from pull request descriptions, issues, and code changes to guide its reviewing agents.
Ingestion points: Pull request content, issue bodies, and git diffs are read in SKILL.md (Step 1) and passed to agents via review.js prompts.
Boundary markers: The skill attempts to isolate instructions using XML-like tags such as <constraints>, <context>, and <your-job>, but these markers are insufficient to prevent an LLM from being influenced by instructions embedded within the code or prose it is reviewing.
Capability inventory: The agent can execute shell commands, interact with GitHub via the gh CLI, and read/write to the local file system.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the pull request before it is processed by the agent or used to derive shell commands.
[PERSISTENCE]: The skill uses a local directory ${XDG_DATA_HOME:-$HOME/.local/share}/review-pr/ to store round results and reports. This mechanism allows state and potential artifacts from malicious reviews to persist on the host system across different sessions.

review-pr