The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to send local code, git diffs, and pull request metadata to external model providers (such as Anthropic and OpenAI) via the agent_start tool. This behavior is the primary purpose of the skill to enable multi-model peer review.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests untrusted data from the local environment (files, git diffs, and PR comments) and interprets instructions from external subagents to modify the codebase.
Ingestion points: Reads code files, git diff output (git diff main...HEAD), and PR descriptions/comments (documented in sections 3 and 5 of SKILL.md).
Boundary markers: Includes instructions to tell subagents the work is "read-only" and explicitly notes that the instruction in the prompt serves as the boundary.
Capability inventory: The parent agent can start external subagents (agent_start), modify local files ("Make the changes you agree with"), and execute shell commands ("run the relevant checks").
Sanitization: The skill includes a verification requirement for the agent: "Check a finding against the code before you accept it. A delegate's confidence is no evidence."
[COMMAND_EXECUTION]: The instructions direct the agent to "run the relevant checks" before and after rounds, which involves executing local build or testing tools based on the project's configuration.

council