The Agent Skills Directory

[COMMAND_EXECUTION]: The skill generates and executes shell commands using uvx, tox, and pip to install dependencies and set up environments for code analysis. These commands are necessary for the skill's stated purpose of auditing instrumentors against their target libraries.
[EXTERNAL_DOWNLOADS]: Instructions include downloading packages from the Python Package Index (PyPI) and using uvx to run tools. These operations target well-known, standard developer services and repositories.
[DATA_EXPOSURE]: The skill accesses the local file system to read project configuration files (pyproject.toml, tox.ini) and the source code of installed libraries. This data access is required to perform the technical review and is limited to the project context.
[PROMPT_INJECTION]: The skill processes project configuration files to extract package and library names, which are then interpolated into shell commands.
Ingestion points: Reads tox.ini, pyproject.toml, and directory structures to extract <pkg> and <library> variables.
Boundary markers: Absent. The instructions do not specify using delimiters when processing these file contents.
Capability inventory: Execution of shell commands via uvx, tox, and pip.
Sanitization: Absent. The skill does not instruct the agent to sanitize extracted strings before using them in shell commands, creating a potential surface for command injection if project files are maliciously crafted.

python-code-reviewer