The Agent Skills Directory

[Command Execution via Shell Interpolation]: The skill directly interpolates the $ARGUMENTS variable into shell commands, such as gh pr view $ARGUMENTS and gh pr diff $ARGUMENTS. If the input provided by the user contains shell metacharacters, it could potentially lead to the execution of unintended commands within the agent's environment.
[Indirect Prompt Injection Surface]: The skill ingests and processes untrusted data from external sources, specifically PR titles, bodies, and code diffs. This data could contain adversarial instructions designed to influence the agent's review logic or trigger unintended actions.
Ingestion points: Untrusted data is fetched from the repository using gh pr view (metadata) and gh pr diff (code changes) in SKILL.md.
Boundary markers: The skill does not implement specific delimiters or instructions to help the agent distinguish between the PR data and the skill's own operational instructions.
Capability inventory: The skill has the ability to execute shell commands and post comments to GitHub via the gh CLI.
Sanitization: There is no evidence of sanitization, filtering, or validation of the PR content before it is processed by the agent.

review-pr