The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (gh pr view <NUMBER> and gh pr diff <NUMBER>) using a PR number or URL provided by the user. This design creates a command injection vulnerability where a malicious input containing shell metacharacters (e.g., ;, &&, |) could lead to the execution of arbitrary commands in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from GitHub Pull Requests (titles, descriptions, and code diffs) via the gh tool. This creates an attack surface for indirect prompt injection where malicious instructions embedded in the PR could manipulate the agent's review process or verdict.
Ingestion points: Pull Request data fetched through gh pr view and gh pr diff in the shell-based Phase 0.
Boundary markers: The skill does not implement explicit delimiters or instructional guardrails to prevent the agent from following commands embedded within the fetched PR content.
Capability inventory: The skill possesses broad capabilities including Bash, Read, Edit, Write, and Glob tools.
Sanitization: The instructions provide no guidance on sanitizing or validating the external PR content before evaluation.

canon-review