The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and downloads the @anthropic-ai/claude-code package from the official NPM registry for its CI/CD integration. This package is maintained by a trusted organization.
[COMMAND_EXECUTION]: The skill provides automated shell script templates for a git pre-commit hook and a GitHub Actions workflow. These scripts are designed to execute the code review tool locally and in cloud environments.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface in the provided automation templates.
Ingestion points: The pre-commit hook (in SKILL.md) reads staged filenames via git diff, and the GitHub Actions workflow reads changed files in a pull request.
Boundary markers: Filenames are directly interpolated into shell commands without boundary markers or quoting in the examples provided.
Capability inventory: The scripts trigger command execution through the claude CLI and npx environments.
Sanitization: The provided script templates lack sanitization for filenames. If a repository contains files with malicious names (e.g., containing shell metacharacters like semicolons or backticks), it could lead to command injection when the hook or workflow is triggered.

code-review