The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands by concatenating variables like $MODEL and $COMPANION into the RUNNER_ARGS string, which is then executed via bash without proper quoting or escaping. This allows an attacker who can influence the model name or companion configuration to execute arbitrary shell commands.
Evidence: The logic in SKILL.md (Step 5) uses RUNNER_ARGS+=" --model $MODEL" followed by bash "$HOME/.../runner.sh" $RUNNER_ARGS, which is a classic shell injection pattern.
[DATA_EXFILTRATION]: The skill is designed to collect extensive codebase context, including uncommitted changes, full file contents, pull request diffs, and issue discussions, to send them to external AI services (Codex, Gemini, Claude). While this is the intended functionality, users should be aware that their sensitive source code and project metadata are being transmitted to third-party providers.
Evidence: Templates such as templates/changes.md, templates/solve.md, and templates/status.md collect and interpolate $DIFF, $PR_DIFF, and $CONTEXT_BLOCK into prompts for external dispatch.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted data (git diffs, PR bodies, and document contents) directly into the instructions for the external AI models without robust sanitization or "ignore instructions" delimiters.
Evidence: templates/pr.md and templates/changes.md place $PR_BODY and $DIFF directly into the prompt text, allowing malicious instructions embedded in a PR or code file to manipulate the reviewer's output.
[COMMAND_EXECUTION]: The skill uses eval echo ~ to resolve the home directory, which is generally unnecessary and can be risky if the environment is manipulated, although it is a common pattern in shell scripts.

review