The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a utility script scripts/pr-analyzer.py that executes git via subprocess.run to calculate lines added and deleted. The script safely uses a list of arguments rather than a shell string, which prevents command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to process untrusted code diffs and pull requests, it is naturally exposed to indirect prompt injection. 1. Ingestion points: The skill analyzes code provided by the user or referenced via the git repository path in scripts/pr-analyzer.py. 2. Boundary markers: The skill relies on natural language instructions and markdown structure; it does not implement programmatic delimiters. 3. Capability inventory: The skill utilizes local subprocess execution of git. 4. Sanitization: No sanitization of code content is performed as the primary task is qualitative analysis of the code itself.

code-review-excellence