The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to shell command injection. In Step 2, user-provided input from $ARGUMENTS is assigned to PR_URL and then interpolated directly into a double-quoted bash command: claude --remote "... PR: ${PR_URL}". An attacker providing a PR URL containing shell metacharacters (e.g., ;, `, or $()) could execute arbitrary commands on the user's local system.
[REMOTE_CODE_EXECUTION]: The skill uses claude --remote to spawn an autonomous agent session on Anthropic's cloud infrastructure. While this uses an official tool, the lack of sanitization in the parameters passed to this remote session allows an attacker to manipulate the execution environment or logic.
[PROMPT_INJECTION]: The skill creates an Indirect Prompt Injection (IPI) surface. The remote session is instructed to "Watch this PR and auto-fix any CI failures or review comments." Because PR review comments and CI output are untrusted external data that the agent is explicitly told to obey, an attacker could embed malicious instructions in a GitHub review comment to hijack the agent's actions (e.g., instructing it to exfiltrate secrets or introduce backdoors into the code).
Ingestion points: PR URL, GitHub review comments, and CI check failure logs.
Boundary markers: None. The instructions are directly concatenated into the remote agent's prompt.
Capability inventory: The remote agent can read the repository, modify files, push commits, and respond to comments.
Sanitization: None provided for the interpolated PR data or the monitored GitHub events.
[EXTERNAL_DOWNLOADS]: The skill references the official @anthropic-ai/claude-code package for updates, which is a well-known service from a trusted organization.

flux-autofix