The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands through the use of a 'review-token command' defined in repository documentation or provided by other skills. Specifically, references/publication.md uses sh -c to execute this command to retrieve authentication tokens, which can be exploited to run arbitrary code if the command string is malicious.
[DYNAMIC_EXECUTION]: The skill dynamically generates Python and shell scripts (writes.py and write-loop.sh) at runtime and executes them to manage thread replies and resolution on GitHub. This practice makes auditing the skill's behavior difficult and increases the risk of runtime exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests commands from the repository's documentation (docs/agents/issue-tracker.md) to resolve reviewer identities. An attacker could potentially achieve remote code execution (RCE) by submitting a pull request that modifies this file with a malicious command.
Ingestion points: docs/agents/issue-tracker.md (read via logic in references/publication.md).
Boundary markers: None identified to separate the retrieved command from the execution context.
Capability inventory: Subprocess execution (sh -c, python3), file writing, and GitHub API access via the gh CLI tool.
Sanitization: The skill lacks sanitization or validation for the command strings before passing them to the shell's execution environment.

review-code-publish