The Agent Skills Directory

[COMMAND_EXECUTION]: The example webhook-handler.js script uses execSync to run shell commands constructed directly from the event.comment.body string. This creates a critical command injection vulnerability where an attacker can execute arbitrary code on the host system by posting a pull request comment containing shell metacharacters (e.g., /swarm ; rm -rf / ;).
[REMOTE_CODE_EXECUTION]: By combining the webhook listener with unsanitized execSync calls, the skill allows for remote code execution triggered by external GitHub events. This enables unauthorized users with pull request access to run arbitrary scripts on the server running the swarm orchestration.
[PROMPT_INJECTION]: The skill has a high exposure to indirect prompt injection (Category 8).
Ingestion points: Data is ingested from GitHub pull request titles, bodies, diffs, and comments using gh pr view and webhook event payloads.
Boundary markers: The skill lacks delimiters or explicit instructions to the AI agents to ignore embedded commands within the ingested PR data.
Capability inventory: The skill possesses extensive capabilities including code modification, pull request approval/merging, and command execution via the gh CLI and ruv-swarm tools.
Sanitization: No input validation or escaping is present for the data retrieved from GitHub before it is processed by the AI agents or passed to system-level commands.
[EXTERNAL_DOWNLOADS]: The skill relies on npx to execute ruv-swarm, which is a tool provided by the author (ruvnet), and utilizes the GitHub CLI (gh). These external dependencies are required for the skill's primary function and are documented vendor resources.

github-code-review