The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md uses the user-provided $ARGUMENTS directly in shell commands (gh pr diff, git diff). An attacker can provide input containing shell metacharacters such as ;, &&, or | to execute arbitrary unauthorized commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and diffs from external repositories and passes them to specialized AI sub-agents for review, creating an injection surface.
Ingestion points: Code context is gathered in SKILL.md via gh pr diff, git diff, and read file based on the $ARGUMENTS variable.
Boundary markers: None. The skill instructs the agent to provide full file context to reviewers without utilizing delimiters or instructions to ignore embedded commands within the code.
Capability inventory: The skill has the ability to execute local shell commands (git/gh) and spawn multiple sub-agents with broad instructions.
Sanitization: There is no evidence of sanitization, escaping, or validation of the retrieved code content before it is interpolated into prompts for the specialized reviewers.

review