The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill parses the target host from a user-provided PR URL and uses it to set the GITLAB_HOST environment variable. If a sensitive GITLAB_TOKEN is present in the environment, it will be sent to this host when the glab CLI tool is invoked. An attacker could provide a malicious URL to exfiltrate this token.
[DATA_EXFILTRATION]: As described in the credentials finding, sensitive environment tokens can be exfiltrated to an external, attacker-controlled host parsed from the input URL during platform authentication checks and API calls.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PR diffs, descriptions, and author replies. While it uses subagent isolation as a security boundary, this remains a significant attack surface for influencing agent behavior.
Ingestion points: PR/MR URL, diff content, PR description, and harvested author replies.
Boundary markers: The skill explicitly mandates the use of isolated subagents for all review tasks to prevent context bias and instruction leakage.
Capability inventory: The agent executes shell commands via gh, glab, git, and jq to fetch data and publish findings.
Sanitization: The instructions include specific warnings and mitigations (Payload assertions) to avoid shell command substitution vulnerabilities by using file-based inputs (-F body=@file) for CLI tools.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution using git, gh, glab, and jq. While it follows best practices for many operations, it interpolates variables derived from user input into shell strings for API paths, which could lead to command injection if input parsing is bypassed.

pr-review