The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands for repository analysis and metadata retrieval. It uses git diff, git rev-parse, git log, and git blame to inspect the codebase and history. It also uses the GitHub CLI (gh pr view) to fetch pull request context and reviews.
[DATA_EXFILTRATION]: The skill triggers network operations to arbitrary domains. The subagent instructions in references/comment-sicko.md direct the agent to "Open any ticket, issue, or RFC the comment names" to verify constraints. This behavior allows the agent to access non-whitelisted external domains based on content found in untrusted code comments.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in analyzed data.
Ingestion points: Untrusted source code and diffs provided by the caller, specifically targeting comments.
Boundary markers: No delimiters are used to separate code comments from the agent's instructions, nor are there warnings to ignore embedded instructions.
Capability inventory: The agent can read/write local files, execute shell commands (git, gh), and perform network requests.
Sanitization: No validation or sanitization is performed on comment content or the URLs extracted from them before the agent attempts to access or act upon them.
This allows an attacker to use a comment to point the agent to a malicious URL containing instructions that could exploit the agent's capabilities.

no-comments