The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from Git repositories and integrates instructions produced by external AI reviewers.
Ingestion points: scripts/build_review_bundle.py reads repository file contents and ocr tool output. scripts/extract_product_output.py ingests structured results from AI products such as Codex and Claude Code.
Boundary markers: The implementation uses strict JSON schemas (review-schema.json, fix-schema.json) and validation scripts (validate_round.py) to verify the integrity and structure of external content. Instructions in references/review-contract.md explicitly define the expected data shapes.
Capability inventory: The skill utilizes subprocess.run to call Git and OCR binaries. Additionally, SKILL.md (Phase 4) and references/fix-contract.md direct the host agent to 'run listed checks' and 'run the host-owned acceptance checks' derived from the Reviewer findings.
Sanitization: The skill lacks explicit sanitization or filtering logic for the command strings contained within the acceptance_check field of the review findings before they are recommended for execution.
[COMMAND_EXECUTION]: Multiple Python scripts (build_review_bundle.py, extract_product_output.py) invoke shell commands using the subprocess module. These are primarily used to interact with Git and the ocr tool. While the scripts include validation to ensure paths stay within the repository boundary (is_relative_to), this capability allows for the manipulation of the local environment based on instruction parameters.
[SAFE]: The skill demonstrates several security-conscious implementation choices:
Path Validation: The evidence builder verifies that target repositories and output paths are valid and prevents repository escape.
Command Redaction: scripts/build_review_bundle.py includes a redacted_command function specifically designed to prevent sensitive command-line arguments (like background information or file paths) from appearing in logs or error messages.
Capability Limiting: The adapter-contracts.md defines specific, restricted invocation patterns for external tools, such as using safe mode for Claude Code and avoiding dangerous bypass flags for Codex.

open-code-review-loop