The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external, untrusted content including pull request descriptions, commit messages, and issue comments using gh pr view and other commands. This creates an attack surface where a malicious PR author could embed instructions to manipulate the agent's review verdict.
Ingestion points: gh pr view <pr> --comments, gh pr diff <pr>, pull request description, and issue/spec content (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the data being processed.
Capability inventory: The agent has the capability to execute shell commands (gh, git, and local test suites) and post comments to the PR.
Sanitization: No sanitization or validation of the untrusted input text is performed.
[COMMAND_EXECUTION]: The skill makes extensive use of the gh and git command-line tools to interact with the repository. It also instructs the agent to 'Run the neighbouring suite' and 'Run the guard live', which involves executing arbitrary shell commands and scripts found within the repository.
[REMOTE_CODE_EXECUTION]: By design, the skill requires the agent to execute code (tests and verification scripts) from a pull request. Because pull requests are provided by potentially untrusted authors, this functionality implicitly results in the execution of code from an external source. While the instructions emphasize using a 'disposable worktree' and forbid sensitive operations like ssh or aws, the execution of the code itself remains a inherent risk.

adversarial-review