The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/gerrit_api.sh performs shell command execution using curl, jq, and python3. The variable AUTH_HEADER, which contains user-supplied credentials, is used without quoting in multiple curl calls. This creates a potential argument injection vector if the GERRIT_USERNAME or GERRIT_HTTP_PASSWORD environment variables contain spaces or other shell-significant characters.
[EXTERNAL_DOWNLOADS]: The skill communicates with external Gerrit instances via HTTP REST API calls to fetch change metadata, diffs, and file contents. These operations target a user-defined GERRIT_URL which is outside the standard whitelist.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from an external source.
Ingestion points: External code diffs, file contents, and reviewer comments are fetched from Gerrit via scripts/gerrit_api.sh and presented to the agent.
Boundary markers: The instructions do not include delimiters or specific guidance for the agent to ignore or isolate instructions embedded within the retrieved code or comments.
Capability inventory: The agent has the ability to execute network requests, read/write to the file system via standard tools, and perform write operations on the Gerrit server (posting reviews and submitting changes).
Sanitization: There is no evidence of sanitization or validation of the remote content before it is processed by the AI agent.

gerrit-review