The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions mandate that the agent "Dogfood every runnable change yourself at its real entrypoint" and "Reproduce from source... or an executable check." This requires the agent to run code provided in a pull request or diff, which is untrusted external input. Executing such code can lead to a compromise of the agent's environment if the review target is malicious.
[COMMAND_EXECUTION]: The skill requires the agent to execute a local shell script to resolve the pull request base: BASE=$(PR_BASE_REF="${REVIEW_BASE:-}" "${CLAUDE_PLUGIN_ROOT:-.}/scripts/resolve-pr-base.sh"). This involves shell interpolation and execution of a script from a path that defaults to the plugin root.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as PR diffs, logs, and specifications. While it includes basic guardrails (e.g., "Do not trust a PR summary over code"), the lack of strict sanitization combined with the capability to execute the code being reviewed creates a significant attack surface.
Ingestion points: Processes PR diffs, request/spec files, and logs (SKILL.md, DEEP-AUDIT.md).
Boundary markers: Encourages verification and "Dogfooding" rather than trusting prose, but lacks explicit string delimiting for the diff content itself.
Capability inventory: Includes shell command execution and runtime code execution ("Dogfooding").
Sanitization: No explicit sanitization or sandboxing instructions are provided for the execution of reviewed code.
[DYNAMIC_EXECUTION]: The skill utilizes verification commands and executable checks to validate diffs, which involves running dynamically identified commands or scripts based on the content of the review.

review