The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes gh pr checkout "$PR" to switch to the branch of a Pull Request, which may contain untrusted code from external contributors. It then proceeds to 'run the project quality gates' (Step 2 and Step 4). Because quality gates are typically defined as scripts within the repository (e.g., in package.json, Makefile, or test suites), an attacker can submit a PR that modifies these scripts to execute arbitrary malicious code on the agent's environment when the skill is invoked.
[COMMAND_EXECUTION]: The skill uses the $PR_ARG variable, derived from user-provided $ARGUMENTS, directly in shell commands such as gh pr view $PR_ARG. The lack of quoting or sanitization around this variable allows for shell command injection if a user provides a crafted input containing shell metacharacters (e.g., ; malicious_command #).
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted data from multiple points:
Ingestion points: PR diffs (gh pr diff), PR metadata, and reviewer comments processed via the forge-address-pr-feedback sub-skill.
Boundary markers: None are explicitly defined in the instructions to separate untrusted data from agent instructions.
Capability inventory: The skill has broad capabilities including file system access (git checkout/merge), network operations (gh api/push), and execution of repository scripts.
Sanitization: No sanitization or escaping of external content is mentioned before it is processed by the model's review passes. This could allow an attacker to embed instructions in code comments or PR descriptions to manipulate the agent's logic, such as forcing a review-ready state on malicious code.

forge-guard