The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's example webhook-handler.js contains a command injection vulnerability. It uses execSync to process GitHub PR comments by directly interpolating the raw event.comment.body into a shell command. An attacker could craft a PR comment starting with /swarm followed by shell control characters (like ;, &&, or |) to execute arbitrary code on the host machine.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull requests, creating a vulnerability surface.\n
Ingestion points: PR titles, bodies, and diffs are retrieved via gh pr view and gh pr diff and passed to review agents.\n
Boundary markers: There are no explicit instructions or delimiters used to prevent the AI agents from following malicious instructions embedded within the PR content.\n
Capability inventory: The skill possesses extensive capabilities, including the ability to comment on PRs, edit labels, and merge code via the gh CLI tool.\n
Sanitization: No sanitization or validation of the external PR data is implemented before processing.\n- [EXTERNAL_DOWNLOADS]: The skill frequently uses npx ruv-swarm, which results in the download and execution of packages from the npm registry at runtime.\n- [DYNAMIC_EXECUTION]: The register-agent functionality allows the skill to load and execute local JavaScript files as custom review agents at runtime. This poses a risk if an attacker can manipulate files within the workspace before the review swarm is initialized.

github-code-review