The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator instructions in SKILL.md direct the agent to construct and run git commands (e.g., git diff) using a fixed-point reference provided by the user. The instructions explicitly state to "pass theirs through verbatim" when the user names a specific commit, tag, or SHA. This creates a direct command injection vulnerability, as a malicious user could provide a reference string containing shell metacharacters (e.g., ; rm -rf /) which would be executed by the agent's shell environment.
[PROMPT_INJECTION]: The skill ingests untrusted data from the repository being reviewed, including the source code diff, commit messages, and documentation files like CLAUDE.md or spec files. Every sub-agent (Standards, Spec, Architecture, Divergent) processes this content. The lack of boundary markers or instructions to treat this content as untrusted makes the skill vulnerable to indirect prompt injection, where malicious code or comments in the repository could override the sub-agent's review instructions.
[DATA_EXFILTRATION]: The skill possesses the capability to read the repository codebase and metadata and interact with the GitHub API using the gh CLI. While these tools are used for legitimate PR review purposes, the presence of the command execution vulnerability and the ingestion of untrusted repository content creates a path for an attacker to exfiltrate sensitive code or repository configuration by manipulating the agent's output or command execution flow.

review