The Agent Skills Directory

[COMMAND_EXECUTION]: In references/isolated-clone.md, the skill executes arbitrary shell commands defined as build gates (e.g., make check or equivalents found in CLAUDE.md). This execution happens automatically during the PR review process and runs within the agent's current environment.
[REMOTE_CODE_EXECUTION]: The skill fetches code from remote Pull Requests, which may originate from untrusted external forks, and proceeds to execute build scripts within that code. This creates a direct vector for Remote Code Execution where an attacker can gain control over the agent's execution environment by submitting a malicious PR containing a compromised Makefile or build script.
[DATA_EXFILTRATION]: While the skill does not have built-in exfiltration logic, the arbitrary code execution permitted during the build phase allows a malicious actor to harvest and exfiltrate sensitive environment variables, such as the GEMINI_API_KEY or GH_TOKEN required by the skill, or to access local files on the system.

pr-review