The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-supplied $ARGUMENTS into shell commands, specifically within the PR mode logic: gh pr diff <PR_NUMBER> --name-only. If the input is not strictly validated as a numeric PR ID or a valid URL, it presents a risk of command injection where a crafted argument could execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted code for review, which is a significant attack surface for indirect prompt injection. Malicious instructions embedded in comments or string literals within the code could attempt to influence the agent's behavior or the output of delegated review tasks.
Ingestion points: Project source files and git diff output (e.g., from gh pr diff or git diff) in SKILL.md.
Boundary markers: The instructions do not define explicit delimiters or "ignore instructions" warnings when passing gathered code to the delegated orchestrator tasks.
Capability inventory: The skill possesses the Bash tool for local execution and the Task tool for delegating to other agent skills.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the external code content before it is processed or passed to subsequent analysis tasks.

code-review