The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill utilizes environment variables such as $GITLAB_PRIVATE_TOKEN, $GITLAB_TOKEN, and $CI_JOB_TOKEN to authenticate requests to GitLab instances. These sensitive credentials are at risk because they are injected into network requests without proper destination validation.
[DATA_EXFILTRATION]: In Step 2.1, the skill implements a curl fallback for fetching merge request data. The target URL's {base_url} is extracted directly from the user-provided $ARGUMENTS. Since the skill includes the PRIVATE-TOKEN header in this request, a malicious actor could provide a URL pointing to an attacker-controlled domain (e.g., https://attacker.com/repo/-/merge_requests/1) to capture the user's GitLab token.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and analyzing PR/MR diffs, which are untrusted external data sources.
Ingestion points: PR diff content fetched via gh, glab, git, or curl (SKILL.md Step 2).
Boundary markers: The skill uses <safety_instructions> tags to encapsulate warnings about treating diff content as data, not instructions.
Capability inventory: The skill has access to Bash, Write, and Edit tools.
Sanitization: The instructions reference a protocol for stripping hidden characters from the diff content.
[COMMAND_EXECUTION]: The skill frequently uses the Bash tool to interact with version control CLIs (gh, glab, git). While these are functional requirements, the interpolation of user-supplied arguments into shell commands requires robust sanitization to prevent command injection vulnerabilities.

backend-pr-review