The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a shell command defined in the docs/agents/issue-tracker.md file using sh -c. Since this file is part of the repository, a malicious actor could submit a pull request modifying this file to execute arbitrary code when the agent processes the repository. Evidence: GH_TOKEN=$(sh -c '<review-token command>') gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login in SKILL.md.
[DYNAMIC_EXECUTION]: The skill dynamically assembles and executes shell commands based on strings parsed from external configuration files, creating a risk of command injection through the 'Review-token command' mechanism.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from GitHub to drive its core logic. 1. Ingestion points: The skill reads data from GitHub issues, pull request bodies, comments, and the local docs/agents/issue-tracker.md file. 2. Boundary markers: While the skill uses a ## Spec header when creating issues, it lacks explicit "ignore instructions" delimiters when processing external feedback or specifications. 3. Capability inventory: The skill dispatches subagents with the ability to write code (implement-publish), modify files (resolve-review), and interact with the GitHub API via the gh CLI. 4. Sanitization: No sanitization or validation is performed on the data ingested from the forge or documentation files before it is passed to subagents or used in shell commands.

finish-it