The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to interpolate the $ARGUMENTS variable directly into shell commands such as gh pr diff <number or url> and git ... diff <base>...HEAD. This is a classic command injection vector where a malicious user can execute arbitrary shell commands by including metacharacters (e.g., 123; malicious_command) in the input.
[DATA_EXFILTRATION]: The skill's scoring logic in scripts/score.py and the rules defined in SKILL.md specifically target sensitive file paths and keywords. The SENSITIVE and INFRA patterns explicitly include keywords such as password, secret, credential, and .env. Accessing the diffs of these files during the risk-scoring process exposes potentially sensitive information to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted pull request diff data, which creates an attack surface for indirect prompt injection.
Ingestion points: Data is ingested via the output of gh pr diff and git diff commands (File: SKILL.md).
Boundary markers: The instructions do not define any boundary markers or special delimiters to isolate the external diff content from the agent's instructions.
Capability inventory: The skill has access to shell command execution and file reading (File: SKILL.md).
Sanitization: There is no mechanism to sanitize or validate the external diff content, allowing instructions embedded in a PR to potentially influence the agent's behavior.

risk-score