The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute various shell commands and local development tools to identify and reproduce bugs. These include test runners such as cargo test, pytest, npm test, and go test, as well as static analysis tools like cargo clippy, ruff, mypy, golangci-lint, eslint, and spotbugs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code and project manifests from local repositories. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the code or comments of the repository being reviewed.
Ingestion points: Reads project files, manifest files (e.g., Cargo.toml, package.json, go.mod), and source code content (SKILL.md, modules/language-detection.md).
Boundary markers: Uses a verbatim "Anchor" system to cite specific lines of code and provides a citation verifier mechanism to ensure findings are grounded in actual source text (SKILL.md Step 6).
Capability inventory: The skill can execute local build tools, test suites, and static analyzers. It also has file-write capabilities (e.g., writing to .review/findings.json).
Sanitization: Relies on the citation_verifier.py tool from the imbue:review-core skill to validate that findings are not fabricated or influenced by embedded instructions.

bug-review