The Agent Skills Directory

REMOTE_CODE_EXECUTION (CRITICAL): The skill's installation or setup process involves downloading a shell script from an untrusted external repository and piping it directly to bash.
Evidence: curl -fsSL https://raw.githubusercontent.com/SpillwaveSolutions/skilz/main/install.sh | bash
Context: The source SpillwaveSolutions is not on the trusted organizations list. Piping remote content to a shell allows for arbitrary command execution on the host system without verification.
EXTERNAL_DOWNLOADS (HIGH): The skill fetches resources from a non-whitelisted GitHub repository during its operation.
Evidence: Reference to https://raw.githubusercontent.com/SpillwaveSolutions/skilz/.
Context: Downloading scripts or configuration from unknown third-party repositories poses a significant supply chain risk.
INDIRECT_PROMPT_INJECTION (LOW): The skill is designed to ingest and process untrusted data from GitHub Pull Requests (diffs, comments, metadata) and has the capability to execute actions based on that data.
Ingestion points: references/gh_cli_guide.md describes using gh pr view, gh pr diff, and gh api to read PR content.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the provided scripts.
Capability inventory: The script scripts/add_inline_comment.py can write comments to GitHub using the gh CLI.
Sanitization: While the script uses json.dumps to safely pass data to the CLI, it does not sanitize the logical content of the comments, which could be influenced by malicious instructions embedded in the PR being reviewed.

pr-reviewer