The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/gather-reviews.ts script uses execSync to execute the gh (GitHub CLI) command. It constructs the command string by directly interpolating the owner and name variables, which are derived from user-supplied command-line arguments. An attacker can inject arbitrary shell commands by providing a repository string that includes shell metacharacters (e.g., owner/repo"; <malicious_command>; #), enabling unauthorized code execution with the privileges of the agent.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted content from GitHub pull request comments and reviews. An attacker could place malicious instructions within a PR comment which, when fetched and presented to the agent, could influence its behavior.
Ingestion points: Data is fetched from the GitHub API using the gh tool in scripts/gather-reviews.ts.
Boundary markers: The script wraps fetched comments in Markdown blockquotes (>), but lacks explicit system instructions telling the agent to treat this content as untrusted or to ignore instructions embedded within the data.
Capability inventory: The environment provides capabilities for shell command execution (execSync) and potential file system interaction.
Sanitization: The script performs basic newline replacement to maintain Markdown blockquote formatting but does not filter the content for malicious instructional patterns.

GitHub PR comment fetcher