The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted external data from GitHub pull request comments and code suggestions (ingested via scripts/fetch-pr-data.sh) without sanitization or boundary markers. This data directly influences file modifications via the Edit tool and command execution via npm run or uv run, allowing a malicious reviewer to potentially trigger unauthorized actions or embed backdoors.
[COMMAND_EXECUTION]: The skill uses dynamic context injection in the SKILL.md file (e.g., !git remote -v) to gather environment information. It also allows the execution of project-defined scripts through npm run, uv run, and pre-commit hooks. These tools can execute arbitrary code based on the contents of the repository being processed.
[EXTERNAL_DOWNLOADS]: The skill performs git pull and git fetch operations, which involve downloading code and metadata from remote git repositories. This is a standard part of the workflow but represents an ingestion of external code.
[DATA_EXFILTRATION]: The skill transmits repository metadata, commit information, and modified source code to GitHub's servers via git push and the gh api. While this is the intended functionality, it constitutes a managed flow of data to an external service.

git-pr-feedback