The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution feature (! syntax) in SKILL.md to run scripts/context.sh during the initialization phase. The manifest interpolates the $ARGUMENTS variable directly into a shell command: !bash ${CLAUDE_SKILL_DIR}/scripts/context.sh $ARGUMENTS. This represents a severe command injection vulnerability, as a user providing a payload containing shell metacharacters (e.g., semicolons, backticks, or pipe symbols) could execute arbitrary shell commands on the host system.
[COMMAND_EXECUTION]: The skill relies on executing local shell scripts and the GitHub CLI (gh) to gather repository information. While these tools are used for the skill's intended purpose, their execution environment is directly impacted by the aforementioned command injection vulnerability via the $ARGUMENTS variable.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external sources, specifically GitHub commits and pull requests, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent's context through SKILL.md via the output of scripts/context.sh, which fetches pull request titles, descriptions, commit bodies, and file diffs.
Boundary markers: The gathered data is organized with basic text headers (e.g., == commits being collapsed ==), but there are no robust delimiters or specific instructions for the agent to treat this content as purely data or to ignore any instructions embedded within it.
Capability inventory: The skill utilizes the gh CLI and local shell scripts to perform its review. The agent's generated verdict influenced the merge workflow, providing a pathway for malicious content to affect development operations.
Sanitization: No sanitization, filtering, or escaping is applied to the content retrieved from the GitHub API before it is presented to the agent.

review-squash-message