The Agent Skills Directory

[OBFUSCATION]: The skill uses a systematic character substitution technique, replacing the forward slash / with a dollar sign $ in numerous locations throughout the SKILL.md file. This pattern is applied to file paths (e.g., .github$workflows$auto-review.yml), API endpoints (e.g., $repos/:owner/:repo$pulls), regular expressions (e.g., TODO$gi), and external URLs (e.g., https:/$github.com$ruvnet$ruv-swarm). This obfuscates the true nature of these strings from standard static analysis tools.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub Pull Requests, including the PR title, body, diff, and user comments. This data is used to drive AI-powered "swarm" agents that have the capability to interact back with the GitHub repository.
Ingestion points: Untrusted data enters the agent context through commands like gh pr view and gh pr diff used to extract PR metadata and code changes, as well as via the monitoring of PR comments.
Boundary markers: There are no explicit delimiters or instructions provided to the agents to ignore or sanitize embedded instructions within the processed PR data.
Capability inventory: The agents can perform significant actions using the GitHub CLI, such as posting comments, submitting reviews, requesting changes, and modifying PR labels.
Sanitization: The skill does not demonstrate any validation or filtering of the external PR content before it is processed by the agents or used in subsequent commands.
[COMMAND_EXECUTION]: The documentation includes a webhook handler example that demonstrates a critical command injection vulnerability. The provided JavaScript snippet uses execSync to execute shell commands constructed by directly interpolating raw, unsanitized text from PR comments (event.comment.body). An attacker could exploit this by posting a comment containing shell metacharacters to execute arbitrary code on the system running the webhook.
[DYNAMIC_EXECUTION]: The skill features a mechanism for registering custom review agents by dynamically loading JavaScript files from the local filesystem using the npx ruv-swarm github register-agent command. This allows for the runtime execution of logic defined in external files.
[EXTERNAL_DOWNLOADS]: The skill relies on npx ruv-swarm to fetch and execute tools from the npm registry. While these resources are associated with the skill's author, the use of npx results in the download and execution of code at runtime.
[REMOTE_CODE_EXECUTION]: The skill frequently invokes npx ruv-swarm, which downloads and executes packages from a remote registry. Additionally, the vulnerable webhook example provides a path for remote attackers to achieve code execution via malicious Pull Request comments.

github-code-review