The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from the local Git repository for AI-assisted review. This presents a surface for indirect prompt injection if a reviewed file contains instructions intended to manipulate the AI Reviewer. The skill actively mitigates this risk through multiple layers of defense: it uses strictly defined JSON output schemas, configures external AI CLIs with non-interactive read-only sandboxing (e.g., safe-mode for Claude Code, read-only sandboxes for Codex and Grok), and performs independent host-side verification of all changes, rejecting out-of-scope writes. This surface is fundamental to the skill's purpose and is managed securely.
Ingestion points: Repository files are read by scripts/build_review_bundle.py and encapsulated in a JSON bundle for the Reviewer.
Boundary markers: Explicit JSON schemas (review-schema.json, fix-schema.json) and product-specific read-only flags (e.g., --sandbox read-only, --safe-mode) are used to constrain model behavior.
Capability inventory: Subprocess calls are restricted to git, ocr, and specific AI products, managed via list-based arguments.
Sanitization: The host agent validates all structured output and re-verifies repository state using Git to verify mutations.
[COMMAND_EXECUTION]: The skill orchestrates external tool invocations (git, ocr, AI CLIs) using subprocess.run with list-based arguments in its Python scripts, which effectively prevents shell injection vulnerabilities. Additionally, scripts/build_review_bundle.py implements path validation to ensure repository-relative access and prevent path traversal attacks.

open-code-review-loop