The Agent Skills Directory

[COMMAND_EXECUTION]: The skill incorporates $ARGUMENTS (such as PR numbers or URLs) directly into shell commands like gh pr view <番号> and script calls. Without strict validation of these arguments, the skill is vulnerable to command injection if a user provides specially crafted inputs containing shell metacharacters.
[PRIVILEGE_ESCALATION]: The skill instructs the use of the --dangerously-skip-permissions flag when invoking the agy and claude CLI tools. This flag explicitly disables the security prompts that require user approval before an agent can execute potentially dangerous tools. This significantly elevates the risk by allowing an agent to perform actions like modifying files or executing arbitrary shell commands without the user's knowledge.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: It reads PR descriptions, issue comments, and codebase diffs from GitHub and local files, which are often controlled by external contributors.
Boundary markers: While the collected data is placed within HTML tags in a context.html file, there are no robust instructions provided to the subagents to treat this content as untrusted data or to ignore any instructions found within it.
Capability inventory: The reviewing agents are granted high-privilege tools such as Bash, Write, and Grep.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is passed to the AI models for review.

review