The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/review-it uses the eval command to process the string passed to the --parallel-tests parameter. This pattern allows for the execution of arbitrary shell commands if the input is not strictly controlled.
Evidence: In scripts/review-it, the script executes eval "$TESTS" > /tmp/review-it-tests-$$.log 2>&1 & where $TESTS is a command-line argument.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of arbitrary, dynamically provided command strings at runtime through its parallel test feature, which lacks validation or sandboxing.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze git diff output from local changes or Pull Request branches. This creates a surface for indirect prompt injection where malicious instructions embedded in the code (e.g., in comments or string literals) could influence the agent's behavior during the review process.
Ingestion points: The agent reads the content of /tmp/review-it.diff or the output of git diff commands as specified in SKILL.md.
Boundary markers: Absent. The instructions prompt the agent to "review the changes" without specifying boundaries or providing warnings to ignore instructions contained within the diff data.
Capability inventory: The skill has access to the local file system (read/write), network via the GitHub CLI (gh) and git fetch, and arbitrary command execution via the review-it script.
Sanitization: There is no evidence of sanitization or filtering of the diff content before it is processed by the agent.

review-it