The Agent Skills Directory

[DYNAMIC_EXECUTION]: The provided webhook-handler.js example contains a critical command injection vulnerability. It uses execSync to run a shell command constructed by interpolating the event.comment.body directly from a GitHub webhook without any sanitization or validation. A malicious user could craft a pull request comment containing shell metacharacters (e.g., ;, &, |) to execute arbitrary code on the server hosting the handler.
[REMOTE_CODE_EXECUTION]: The skill frequently utilizes npx ruv-swarm, which downloads and executes code from a remote package registry at runtime. As the package ruv-swarm originates from an untrusted source, this constitutes unverified remote code execution.
[EXTERNAL_DOWNLOADS]: The skill relies on external dependencies and tools (such as the ruv-swarm package) downloaded from third-party repositories not listed as trusted vendors, introducing potential supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub pull requests, including diffs, bodies, and comments, which could be used as vectors for indirect prompt injection.
Ingestion points: Untrusted data enters the skill context through the gh pr view and gh pr diff commands documented in SKILL.md.
Boundary markers: The provided examples lack clear boundary markers or instructions to the agent to disregard instructions embedded within the ingested PR data.
Capability inventory: The skill environment possesses high-privilege capabilities, including shell execution (via execSync) and repository modification (via the gh CLI).
Sanitization: There is no evidence of sanitization, validation, or escaping of the ingested data before it is processed by the AI agents.

github-code-review