The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute standard Git commands for repository analysis, including resolving the repository root, HEAD hashes, and generating diffs. The implementation is safe, passing arguments as lists to avoid shell injection and using shlex.quote for generated command placeholders.
[INDIRECT_PROMPT_INJECTION]: As the skill ingests untrusted repository content (diffs and file data) to generate instructions for another agent, it possesses an indirect prompt injection surface. This is mitigated through a strong evidence chain:
Ingestion points: Diff outputs and repository file content are processed by the write_review_prompt.py script.
Boundary markers: The skill defines a strict Markdown template with specific headers and backtick-fenced code blocks to delimit repository data from agent instructions.
Capability inventory: The skill's active operations are restricted to Git read-only commands and writing Markdown prompt files into a Git-ignored directory (.review-handoff/).
Sanitization: The write_review_prompt.py script includes a validate_body function that uses regular expressions to detect and block the inclusion of private keys or credential-bearing URLs in the generated prompt.
[SAFE]: No malicious patterns, such as obfuscation, persistence, or unauthorized data exfiltration, were detected. The skill follows security best practices for local file handling and repository boundaries.

review-prompt-composer