The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes code review comments fetched from GitHub, GitLab, and Perforce as instructions for modifying source code. This creates a vulnerability where an attacker who can comment on a pull request, merge request, or changelist might inject malicious instructions that the agent would then execute as part of its iterative improvement cycle.
Ingestion points: External data is ingested in SKILL.md through commands such as gh api .../comments, glab api .../notes, and p4 describe.
Boundary markers: No delimiters or safety instructions are provided to help the agent distinguish between legitimate bot feedback and potentially malicious content within the same comments.
Capability inventory: The skill utilizes file system write access to apply fixes and has the capability to push those changes back to remote repositories using git push or p4 shelve (identified in SKILL.md).
Sanitization: There is no evidence of filtering, escaping, or validation of the input text before it is used to guide code modifications.
[COMMAND_EXECUTION]: The skill uses various version control CLI tools (git, gh, glab, p4) to perform repository operations, check status, and resolve review threads. These tools are granted broad access to the project's source code and repository state, which is necessary for the skill's primary function but represents a significant capability.

greploop