The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md provides installation instructions that pipe a remote script directly to the shell: curl -fsSL https://raw.githubusercontent.com/SpillwaveSolutions/skilz/main/install.sh | bash. This script originates from the vendor's official repository for the Skilz Universal Installer.
[COMMAND_EXECUTION]: Multiple scripts (scripts/fetch_pr_data.py, scripts/add_inline_comment.py) utilize subprocess.run to execute shell commands. These scripts interact with git for repository management and gh (GitHub CLI) for API operations such as fetching PR metadata, diffs, and posting comments. The commands are constructed using list-based arguments which mitigates direct shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external GitHub Pull Requests, which constitutes a significant attack surface for indirect prompt injection.
Ingestion points: scripts/fetch_pr_data.py fetches the PR title, body, comments, and diff contents from GitHub.
Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings when processing the untrusted PR content.
Capability inventory: The agent has the capability to write files, execute git/gh commands, and post comments back to GitHub.
Sanitization: Content is processed as standard strings/JSON without specialized sanitization to prevent the agent from following instructions embedded within a malicious PR.
[DYNAMIC_EXECUTION]: The script scripts/generate_review_files.py dynamically generates markdown files in .claude/commands/ (e.g., send.md, show.md). These files function as executable slash commands for the agent environment, enabling the agent to perform actions like posting reviews or opening VS Code based on paths and metadata generated at runtime.

pr-reviewer