Mutable remote content is treated as agent instructions
Source references: 2The Skill fetches an unpinned GitHub file before every review and says to apply “all rules and output format instructions” from it. That remote file is outside the supplied, auditable Skill content; its instructions can change later through an upstream edit, compromised repository access, or account takeover.
A malicious or accidental upstream change could steer the agent beyond prose review—for example, to read additional files, disclose document content, invoke tools, or conceal the real findings. The evidence does not show that this has happened; the risk arises only if a harmful version is fetched and followed.
The live workflow fetches content on every review from a GitHub Raw URL that is not pinned to a commit or version, then treats all remote rules and output-format text as instructions. If the repository content or control changes, that text could alter the review, influence decisions based on its findings, or direct actions beyond prose review. Users can ask the author to pin and verify an audited revision, or restrict fetched content to reference data that cannot issue agent instructions.
1. Fetch the latest guidelines from the source URL below2. Read the specified files (or prompt user for files/pattern)3. Check against all rules in the fetched guidelines4. Output findings in the terse `file:line` formatShow 1 other places
Fetch fresh guidelines before each review:```https://raw.githubusercontent.com/vercel-labs/writing-guidelines/main/command.md```Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.