The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions include workflows that execute code from checked-out pull requests using 'npm install', 'npm test', and 'npm run build'. This can result in the execution of arbitrary scripts provided by the author of the pull request, such as Node.js lifecycle scripts (post-install hooks) or scripts within the test suite.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI ('gh') and Node.js tools ('npm') to perform operations. The use of shell commands to interact with external, unverified pull request content presents a risk if the tool outputs are used unsafely.
[EXTERNAL_DOWNLOADS]: The skill uses the GitHub CLI ('gh pr checkout') to download pull request content from GitHub for review purposes.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from GitHub pull requests (titles, descriptions, comments, and code diffs) and then performs sensitive actions based on that data. 1. Ingestion points: 'gh pr view', 'gh pr diff', and 'gh pr checkout' in SKILL.md. 2. Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to disregard commands or instructions embedded within the pull request content. 3. Capability inventory: The agent has capabilities to write to the file system, execute shell commands ('npm'), and make network API calls ('gh api'). 4. Sanitization: No sanitization or validation logic is defined for the content ingested from pull requests before it is used to influence the agent's behavior.

code-review