The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends executing code from unverified third-party sources. Specifically, it instructs the agent to run the react-doctor package using npx react-doctor@latest in SCANNER-TRIAGE.md and to use the Nimblesite/Deslop GitHub Action in LAYERS.md. Neither the tool authors nor their repositories are on the trusted organization list, representing a risk of executing unverified external code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted content such as code diffs and pull request metadata, creating an attack surface for indirect prompt injection.
Ingestion points: Data enters the agent context through git diff, git show, gh pr view, and git grep operations.
Boundary markers: While instructions guide the agent on what to look for, there are no explicit delimiters or instructions to ignore embedded commands within the diff content to prevent the agent from being influenced by malicious text in the code.
Capability inventory: The agent has access to powerful shell commands (git, gh, npx) that could be abused if an injection is successful.
Sanitization: The skill lacks mention of sanitizing or filtering external code content before it is processed by the AI reviewer.
[COMMAND_EXECUTION]: The skill relies on a wide variety of shell commands and complex pipelines (e.g., git blame, git rev-parse, git fetch --deepen, and multiple grep filters) to resolve review scopes and find removed signals. While these are standard tools, the extensive use of these commands by the agent increases the potential impact of a command injection if inputs are not strictly controlled.

code-review