The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external content, including pull request descriptions, comments, and code diffs. This creates an attack surface where malicious instructions embedded in source code or PR metadata could potentially influence the agent's behavior.
Ingestion points: The skill explicitly reads remote PR URLs, descriptions, comments, and changed files as documented in references/code-review.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate untrusted code content from the agent's execution context.
Capability inventory: The skill utilizes file system reads, git commands (git status, git diff), and references a Python-based installation script.
Sanitization: No sanitization or filtering logic is specified for the data retrieved from external repositories or PRs.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md reference the execution of a local Python script scripts/install-external-skills.py to manage the installation of external dependencies.
Evidence: The fallback instructions recommend running python3 scripts/install-external-skills.py --skill [name] --agent codex. While these are part of the vendor's managed repository structure, they involve executing shell commands to modify the local environment.

code-review