The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes arbitrary shell commands defined in the .ai/agentic.config.json file found within the target repository. Specifically, it runs all commands listed in the validation.commands array during both the initial review and the autonomous autofix cycles. Since a pull request can modify this configuration file, an attacker could submit a PR that includes malicious commands, leading to their execution in the agent's environment.
[COMMAND_EXECUTION]: The skill automatically detects and runs dependency installation commands (such as npm install, cargo install, or pnpm install) inside the isolated worktree. This creates a vector for code execution through malicious post-install scripts or compromised dependencies introduced in a pull request.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from GitHub pull request titles, bodies, diffs, and comments to drive its review and autofix logic.
Ingestion points: Untrusted data enters the agent context via PR metadata (title, body), PR comments, the diff of changed files, and repository-local configuration files.
Boundary markers: The skill instructions do not define clear boundary markers or "ignore instructions" wrappers when processing external PR content.
Capability inventory: The agent possesses high-impact capabilities, including shell command execution (validation.commands), file system writes, and GitHub API interactions to manage labels, reviews, and assignments.
Sanitization: There is no evidence of sanitization, filtering, or validation performed on the PR content before it is interpolated into the agent's prompts.

auto-review-pr