The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using user-provided $ARGUMENTS, such as git show <hash>, git diff <branch>, and gh pr view <input>. This pattern creates a surface for command injection if the underlying platform does not sanitize the input, potentially allowing arbitrary shell command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it is designed to ingest and analyze untrusted data from external sources.
Ingestion points: The agent retrieves data from the local filesystem and remote repositories using git diff, git show, gh pr view, and by reading the full content of modified or untracked files (e.g., via git status).
Boundary markers: The instructions do not implement delimiters or specific "ignore embedded instructions" warnings to separate the code being reviewed from the agent's system instructions.
Capability inventory: The skill utilizes shell command execution (git/gh) and high-level tools such as "Web Search" and an "Explore agent", which could be leveraged if an injection is successful.
Sanitization: No sanitization, escaping, or validation logic is defined for the ingested code content or pull request metadata before it is processed by the LLM.

code-review