The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing kuva, a scientific plotting utility, from a personal GitHub repository (https://github.com/Psy-Fer/kuva) using cargo install. This introduces a dependency on an unverified external binary.
[COMMAND_EXECUTION]: The modules/kuva-visualization.md module describes a workflow for executing dynamically generated Python scripts by piping heredoc content to the interpreter (e.g., `python3
<<'EOF'`). This pattern is used to extract benchmark data from JSON and TSV files for visualization.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests and processes user-controlled source code files, which could contain malicious instructions designed to manipulate the agent's performance findings or subsequent tool usage.
Ingestion points: Files identified via git diff or provided as path arguments to the /performance-review command in SKILL.md.
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions when reading the contents of the target files for AST analysis.
Capability inventory: The skill environment includes capabilities to execute shell commands for git, cargo, python3, pytest, and a local verification script (citation_verifier.py).
Sanitization: No evidence of content sanitization or instruction filtering is provided for the analyzed source code before it enters the processing pipeline.

performance-review