Each run trusts mutable remote instructions
Source references: 3The Skill does not merely consult remote reference material; it explicitly treats “all the rules and output format instructions” in the downloaded file as instructions to follow. The URL targets the main branch without a pinned commit or content check, so a repository change or upstream compromise can alter the reviewing agent's behavior.
Malicious remote instructions could manipulate findings and output and, where the agent has the necessary capabilities, induce disclosure of reviewed file content, access to additional files, network activity, or other actions the user did not authorize. The supplied text does not show that any such action has occurred.
The Skill fetches mutable content from GitHub's `main` branch for every review and explicitly applies all of its rules and output-format “instructions” to the user's files. If the upstream repository, branch, or release process is compromised, that content could change the agent's review behavior, induce broader file access, or distort decisions. The evidence does not show that the current remote file is malicious, but it supports a supply-chain and remote-instruction risk. Users can ask for a pinned, reviewed commit with integrity checking, or require fetched text to be treated only as data.
1. Fetch the latest guidelines from the source URL below2. Read the specified files (or prompt user for files/pattern)3. Check against all rules in the fetched guidelines4. Output findings in the terse `file:line` formatShow 2 other places
Fetch fresh guidelines before each review:```https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md```Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.