The Agent Skills Directory

Execution of Untrusted Code: The skill's 'Validate for real' phase involves building and executing code provided in the Pull Request being reviewed. This includes running scripts like scripts/build-cli.ps1 and invoking resulting binaries. Since Pull Request code originates from external contributors, this capability allows for the execution of untrusted logic in the agent's environment.
Indirect Prompt Injection Surface: The agent processes 'git diff' output and source files from Pull Requests. This data is untrusted and could contain specifically crafted comments or strings intended to influence the agent's review logic or cause it to ignore security findings.
Potential Privilege Escalation: As documented in the skill's security dimension, certain repository tasks—such as certificate installation or Developer Mode activation—may require elevated privileges. The skill notes that if these elevated steps interact with user-writable files, it could lead to unauthorized privilege escalation.
Command Injection Considerations: The skill instructs the agent to exercise changed commands and perform 'red-team' security attempts. If the agent does not properly sanitize inputs when constructing command lines for these tests, it could lead to unintended command execution.

pr-review