The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax (!command) to execute shell commands at load time. The user-supplied PR number ($0) is interpolated directly into multiple shell commands (gh pr diff $0, gh pr view $0, and gh pr diff $0 --name-only) without any sanitization or validation. This allows a user to execute arbitrary shell commands by providing a crafted input containing command separators or shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external pull requests that could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: External content is brought into the agent's context through gh pr diff and gh pr view output.
Boundary markers: The skill lacks delimiters or specific instructions to prevent the agent from following commands embedded in the PR code or description.
Capability inventory: The agent has access to Bash(gh *) and Bash(nx *) tools, which could be exploited if an attacker successfully injects instructions into the PR being reviewed.
Sanitization: No validation or sanitization is performed on the data returned by the GitHub CLI before it is processed by the agent.
[COMMAND_EXECUTION]: The skill facilitates the execution of gh and nx CLI tools. While these are intended for legitimate PR review workflows, the combination of command injection in the load phase and the broad command patterns allowed (gh *, nx *) increases the potential impact of an exploit.

review-pr