The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill dynamically executes commands defined in the repository under review. Specifically, it uses eval to run installation and verification scripts (e.g., npm ci, npm test, or Makefile targets) detected in the project files. While execution is attempted in a temporary git worktree, the commands run on the host environment. This allows a malicious contributor to gain code execution by submitting a pull request that modifies these configuration files.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to perform repository management, including git worktree operations, gh/glab CLI interactions, and script execution. This level of system access is necessary for its function but increases the impact of any potential exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external trackers and forge platforms to perform its review.
Ingestion points: Requirements from issue bodies, prior review feedback from comments, and code changes from diffs are loaded into the agent context in SKILL.md Step 5.
Boundary markers: The instructions do not specify the use of strict delimiters or explicit instructions for the LLM to ignore embedded commands within the ingested data.
Capability inventory: The agent has the ability to write comments, move labels, and execute shell commands, meaning a successful injection could influence repository state or trigger malicious actions.
Sanitization: There is no evidence of sanitization or filtering of external text before it is presented to the adversarial review logic.
[EXTERNAL_DOWNLOADS]: The skill fetches data and code from GitHub and GitLab and references a schema file from raw.githubusercontent.com/TitusKirch/skills. These are considered vendor-controlled resources as the skill author is tituskirch.

work-review