The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to interpolate untrusted output from gh pr diff directly into shell command strings for Codex and Gemini analysis. A malicious pull request could include shell metacharacters or quotes designed to break out of the command string, leading to arbitrary command execution in the agent's environment (File: SKILL.md, Steps 4 and 8).
[DATA_EXFILTRATION]: The workflow transmits PR diffs and sensitive infrastructure configuration files (e.g., init.tf, locals.tf, validation-contract.tf) to external AI services like Codex and Gemini. This exposes internal code and potentially sensitive logic to third-party providers (File: SKILL.md, Steps 4 and 8).
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted PR content and passes it to LLMs. Ingestion points: gh pr diff and gh pr view output. Boundary markers: Absent; the data is not wrapped in protective delimiters or 'ignore' warnings. Capability inventory: Shell command execution (gh, git, terraform) and network transmission via external AI tools. Sanitization: Absent; no filtering or escaping of the diff content is performed (File: SKILL.md, Category 8 risk).
[EXTERNAL_DOWNLOADS]: The workflow includes running terraform init -upgrade on branches checked out from untrusted pull requests. This allows a malicious PR to trigger the download and execution of untrusted Terraform providers or modules from external sources during initialization (File: SKILL.md, Step 5).

review-pr