The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch additional instructions and command references from a remote repository (https://raw.githubusercontent.com/nexu-io/looper/main/...). Since this source is not part of the established trusted organizations list, fetching and following these instructions is a security concern.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and act upon GitHub review threads and comments, which are untrusted external data sources. An attacker could post a review comment containing malicious instructions designed to trick the agent into performing unauthorized actions.
Ingestion points: The skill uses gh api graphql to fetch reviewThreads and comment bodies in SKILL.md (Step 1 of the Live loop).
Boundary markers: There are no explicit boundary markers or instructions to ignore potential commands embedded within the retrieved comment text.
Capability inventory: The skill has the capability to perform code changes (git commit), push code to remote branches (git push), dismiss reviews (gh api graphql mutation), and merge pull requests (gh pr merge).
Sanitization: No sanitization or validation of the comment content is performed before the agent interprets and acts upon the feedback.
[COMMAND_EXECUTION]: The skill relies on and executes the looper CLI utility, which is a third-party tool not commonly found in standard operating environments. This represents a dependency on an external binary from an unverified vendor.

looper-pr-takeover