The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly commands the agent to run 'npm test' and 'npm run release-check' on the branch being reviewed. Since these commands execute scripts and tests that may be modified by an external, untrusted Pull Request author, this pattern allows for arbitrary code execution on the agent's environment.
[DYNAMIC_EXECUTION]: The review process requires running local Python scripts (e.g., 'scripts/_contract.py', 'demos/build.py') and package-defined scripts. A malicious contributor can modify these files within a Pull Request to perform unauthorized operations when the agent attempts to verify the change.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external Git diffs and Pull Request content. This data can contain adversarial instructions or embedded code aimed at exploiting the agent's execution capabilities.
Ingestion points: Untrusted content is fetched via 'git fetch origin' and processed using 'git diff' and 'git show' (as seen in SKILL.md and references/review-checklist.md).
Boundary markers: There are no instructions or delimiters provided to isolate the untrusted PR content from the agent's core instructions.
Capability inventory: The skill utilizes shell-based capabilities including 'npm' and 'python3' execution, which are directed at the untrusted repository content.
Sanitization: No sanitization, validation, or integrity checks are performed on the PR code before it is executed or analyzed.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands ('git', 'npm', 'python3', 'grep') to inspect the codebase. This reliance on the shell to interact with potentially compromised project files increases the attack surface for command injection or execution of malicious logic embedded in the repository structure.

reviewing-ffmpeg-skill-changes