The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed in Step 2 to execute the project's 'gates' (lint, format check, type check, tests) on the head of an untrusted pull request. An attacker could embed malicious commands within the project's configuration files (e.g., package.json scripts, Makefile, or CI configurations) which the agent would then execute automatically during the review process.
[DYNAMIC_EXECUTION]: In Step 4 (Confirm), the skill instructions explicitly direct the agent to 'Run code when reading cannot settle a suspect,' such as testing a regex on long inputs, running a parser on a 'hostile value,' or executing tests with safety guards removed. Since this code originates from the untrusted pull request being reviewed, it constitutes execution of potentially malicious code.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from multiple external sources.
Ingestion points: Pull request descriptions, commit messages, linked issues, specifications, and the code diff itself (SKILL.md Steps 1 and 2).
Boundary markers: The instructions do not define clear delimiters or 'ignore embedded instructions' warnings for the data being processed.
Capability inventory: The agent has the capability to run subprocess commands (lint, test, etc.) and perform dynamic code execution (SKILL.md Steps 2 and 4).
Sanitization: There is no mention of sanitizing or escaping the data extracted from the pull request before it is used to influence the agent's review logic or the 'guarantees' it derives.

pr-review