The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions involve interpolating the $ARGUMENTS variable directly into shell commands such as gh pr diff $ARGUMENTS, gh pr view $ARGUMENTS, and gh pr checks $ARGUMENTS. This represents a command injection vulnerability where a user could provide a malicious string (e.g., ; rm -rf /) to execute arbitrary commands.
[REMOTE_CODE_EXECUTION]: The instructions require the agent to run npm run lint and npm run test. These commands execute scripts defined in the package.json file of the repository being reviewed. If the skill is used to review code from an untrusted source or a malicious pull request, those scripts could contain arbitrary code that executes on the runner.
[PROMPT_INJECTION]: The skill has a significant indirect prompt injection surface.
Ingestion points: The agent reads untrusted data from gh pr diff and gh pr view output, as well as the full content of changed files (SKILL.md).
Boundary markers: The instructions lack any boundary markers or warnings to the agent to ignore instructions embedded within the code being reviewed.
Capability inventory: The skill uses high-privilege tools including gh (with API access), git, and npm (SKILL.md).
Sanitization: There is no sanitization or escaping of the diff content or PR metadata before it is processed by the agent.

code-review