The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands and Python scripts to perform validations and tests. Specifically, it runs make test, make lint, and make typecheck within the directories of plugins identified as 'affected' by changes. It also executes internal utility scripts such as plugins/abstract/scripts/validate_plugin.py and plugins/sanctum/scripts/meta_evaluation.py. Executing code from directories being reviewed (especially in PR contexts) poses a risk if those directories contain malicious logic designed to exploit the reviewer's environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from plugin source code, metadata, and git diffs. This information is passed to other evaluation skills (e.g., skills-eval, hooks-eval) without documented sanitization, boundary markers, or specific instructions to ignore embedded agent directives. This creates a surface where a malicious plugin could influence the agent's behavior during the review process.
Ingestion points: Reads files in plugins/*/, docs/plugin-dependencies.json, and output from git diff.
Boundary markers: None identified in the orchestration logic.
Capability inventory: Subprocess execution (python, make, git), file system access (read/write), and network capabilities (via dependencies like skills-eval).
Sanitization: No evidence of input escaping or content filtering before processing.

plugin-review