The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes a structural vulnerability to indirect prompt injection by processing untrusted content from external repositories.
Ingestion points: Untrusted inputs enter the agent context through pull request details, file diffs, and user-supplied issue or pull request comments fetched via gh pr view, gh pr diff, and webhook events.
Boundary markers: Absent. No distinct delimiters or defensive system instructions are employed to prevent the agent from executing instructions embedded within the PR code or comment data.
Capability inventory: The skill maintains substantial administrative capabilities over the repository, including posting inline comments, modifying labels, requesting changes, and triggering auto-merges via the GitHub CLI.
Sanitization: Absent. Data from external contributors is integrated into active automated loops without escaping or input validation.
[DYNAMIC_EXECUTION]: The example code snippet for webhook-handler.js in SKILL.md contains an insecure implementation where incoming comment text (event.comment.body) is concatenated directly into a shell string inside execSync(). This presents a high risk of command injection if adapted into environments without sanitization.
[COMMAND_EXECUTION]: Coordinated execution of shell utilities (gh and npx ruv-swarm) is leveraged to automate the review management pipeline, which aligns with the stated functional purpose of the skill.

github-code-review