The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains logic in SKILL.md to programmatically extract the GITHUB_TOKEN from ~/.hermes/.env or the user's ~/.git-credentials file. While this is used for legitimate GitHub API authentication, it demonstrates a pattern of accessing sensitive credential stores.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands (git, gh, curl) and pipes data into python3 scripts for JSON processing. It also allows for local test execution (python -m pytest, npm test) which could be exploited if the PR code being reviewed contains malicious tests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PRs, including titles, descriptions, and file diffs.
Ingestion points: SKILL.md uses curl and gh pr view to fetch PR metadata and content.
Boundary markers: There are no explicit instructions or delimiters used when the agent reads PR descriptions or diffs to ignore embedded instructions.
Capability inventory: The skill can write review comments back to GitHub, execute shell commands, read local files, and run test suites.
Sanitization: The skill lacks sanitization of the PR body or diff before processing, creating a risk where an attacker could embed instructions in a PR to influence the agent's review or local command execution.

github-code-review