The Agent Skills Directory

[SAFE]: The skill is entirely instructional and serves as a reference guide for code reviews. It does not contain any executable scripts, hidden command triggers, or network exfiltration patterns. All provided code examples are for educational purposes within the context of a Java development environment.
[EXTERNAL_DOWNLOADS]: The documentation references various standard Spring ecosystem dependencies, such as Micrometer, Resilience4j, and P6Spy. These are widely recognized, legitimate libraries hosted on official registries. All linked URLs point to trusted domains, including spring.io, oracle.com, openjdk.org, and owasp.org.
[COMMAND_EXECUTION]: The reference file references/security-checklist.md contains examples of insecure code patterns, such as the direct use of Runtime.getRuntime().exec(). These are explicitly labeled as vulnerabilities to be identified during a code review, rather than instructions for the agent to perform command execution.
[INDIRECT_PROMPT_INJECTION]: While the skill is designed to process untrusted user code, it lacks any instructions for the agent to perform sensitive operations like writing to the filesystem or making external network calls. The scope is limited to reading and analyzing code based on the provided reference guides.

code-reviewer