The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow executes several Node.js scripts (such as check-doc-links.js, resolve-review-profile.js, and review-state.js) directly from the repository's scripts/ directory. If the project being reviewed is untrusted, it could include malicious code in these scripts that the agent would then execute on the user's system using the Bash(node:*) tool.
[DYNAMIC_EXECUTION]: In Step 5, the skill instructions specifically search for and attempt to run a script located at a hidden path (.claude/scripts/review-state.js). This allows a repository to override default agent logic with its own executable code, increasing the risk of unauthorized behavior.
[INDIRECT_PROMPT_INJECTION]: The skill ingests markdown documents from the project to perform reviews. These documents are untrusted data that could contain instructions designed to manipulate the AI agent's findings or trigger unauthorized actions. * Ingestion points: The workflow uses git show and the Read tool in Steps 1 and 4 to identify and ingest file content. * Boundary markers: The prompt template uses triple backticks for metadata but lacks robust delimiters or explicit instructions to ignore embedded commands within the markdown body. * Capability inventory: The agent has access to Bash(node:*), Task, Grep, and other tools, creating a significant attack surface if an injection is successful. * Sanitization: There is no evidence of input filtering or content sanitization.

doc-review