The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses the $ARGUMENTS variable and pull request diffs within its instructions and scripts. These inputs are directly interpolated into Large Language Model prompts, creating a risk for both direct and indirect prompt injection. Malicious instructions embedded in the code being reviewed could potentially influence the agent's feedback or downstream actions.
[COMMAND_EXECUTION]: The provided Python and shell script examples utilize system calls and subprocesses to run static analysis tools like sonar-scanner and semgrep. If variables such as the repository name or PR number are influenced by external input without strict validation, it could lead to command injection vulnerabilities within the CI/CD pipeline.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data (diffs and arguments) which is then passed to automated tools and AI models.
Ingestion points: The ai_review method in the orchestrator script and the Requirements section in SKILL.md ingest untrusted content.
Boundary markers: The prompts use basic text delimiters like **Modified Code:**, but lack explicit instructions to the AI to ignore instructions found within the data, making it vulnerable to adversarial content.
Capability inventory: The system is capable of executing shell commands, interacting with the GitHub API for review comments, and performing network requests to Anthropic and OpenAI APIs.
Sanitization: No sanitization, escaping, or filtering of the input diffs or arguments is performed before they are processed by the LLMs.

performance-testing-review-ai-review