The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands, including git, python3, and jq, to inspect the project state and run analysis tools. These operations are core to the skill's functionality but involve significant interaction with the host environment.
[REMOTE_CODE_EXECUTION]: The skill attempts to execute local scripts found within the repository being reviewed (tools/cc-scan.py and tools/arch-scan.py). Since the contents of the repository—especially in a Pull Request context—are untrusted, a malicious contributor could include malicious code in these tool scripts to achieve arbitrary code execution on the agent's system when a review is requested.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted data (file names) from the repository and interpolating them directly into shell commands without quoting or sanitization.
Ingestion points: Data is ingested from the output of git diff --name-only and git log.
Boundary markers: None. The skill assumes repository content and metadata are benign and does not instruct the agent to validate them.
Capability inventory: The agent possesses the capability to execute shell commands (python3, git, jq, grep) on the host system.
Sanitization: None. The use of subshell expansion ($(...)) to pass file lists directly to the Python scanner is vulnerable to command injection if a repository contains files with names designed to break out of the command string.

clean-code-review