The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's PR description file and git logs to perform its review. An attacker could potentially influence the agent's behavior by embedding malicious instructions in these processed files.\n
Ingestion points: Read operations on PR_AGENTDESC.md, git log, and git diff outputs in the 'Gather the inputs' section.\n
Boundary markers: None identified. The instructions do not specify delimiters or instructions to ignore embedded commands in the PR data.\n
Capability inventory: Access to shell tools including cat, sed, and git.\n
Sanitization: No evidence of input validation or sanitization for the data read from the repository.\n- [COMMAND_EXECUTION]: The skill instructs the agent to extract a value from the user-controlled PR_AGENTDESC.md file and interpolate it into shell commands.\n
Evidence: The skill uses sed to extract the base branch from PR_AGENTDESC.md and then uses that result in git -C \"$REPO\" log ... <base>..HEAD and git -C \"$REPO\" diff <base>...HEAD.\n
Risk: If the base: line in the pull request description contains shell metacharacters (e.g., ;, &&, or backticks), it could lead to command injection when the agent executes the subsequent git commands.

review-pr-description