The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from Pull Request and Merge Request contents.
Ingestion points: The skill reads external data via gh pr diff, gh pr view, glab mr diff, and glab mr view (e.g., in Step 1 and Step 3).
Boundary markers: No explicit boundary markers or instructions to ignore embedded malicious content within the pull request data are present.
Capability inventory: The agent has access to sensitive environment variables (JIRA_API_TOKEN, LINEAR_API_KEY) and can execute shell commands (npm test, pytest, curl, gh, glab).
Sanitization: The skill does not perform sanitization on the ingested content, processing it directly using grep and passing it to test runners.
[COMMAND_EXECUTION]: In Step 4, the skill instructs the agent to run local test commands such as npm test and pytest on the codebase being reviewed. Because this code originates from an untrusted source (a Pull Request), a malicious contributor could craft a PR that modifies test scripts (e.g., in package.json or conftest.py) to execute arbitrary malicious code when the agent attempts to run the tests locally.

pr-review-expert