The Agent Skills Directory

[COMMAND_EXECUTION]: The parsing logic in Step 1 extracts owner and repository names from the user-provided PR reference (e.g., via $ARGUMENTS). These variables are then used inside double-quoted strings in shell commands like gh api and gh pr view. This allows an attacker to execute arbitrary commands by crafting a PR reference containing subshell syntax (e.g., $(whoami) or backticks).
[DATA_EXFILTRATION]: Combined with the command injection vulnerability, an attacker could execute commands to exfiltrate sensitive environment variables, credentials, or local files to an external server using tools like curl or wget within the injected subshell.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by fetching PR comments and displaying them to the agent.
Ingestion points: External content is fetched from three GitHub REST endpoints for PR comments and reviews in SKILL.md.
Boundary markers: Absent. No delimiters or escape sequences are used to separate the fetched comment content from the agent's instructions.
Capability inventory: The environment includes the gh CLI with authenticated access to GitHub repositories, allowing for potential state-changing operations if manipulated.
Sanitization: The skill applies basic whitespace normalization and string truncation to 120 characters in Step 6 and Step 7, which does not prevent functional instruction injection.

gh-pr-comments-all