The Agent Skills Directory

[SAFE]: The skill provides a structured workflow for a local development tool without suspicious external dependencies or remote execution patterns.
[COMMAND_EXECUTION]: The skill utilizes standard development commands such as clawpatch review, git diff, and npm test to perform its stated functions. These operations are consistent with the intended purpose of repository auditing and maintenance.
[PROMPT_INJECTION]: The skill's workflow exposes an indirect prompt injection surface by analyzing repository content which could contain malicious instructions.
Ingestion points: Reads repository files during the clawpatch review and clawpatch map phases, and can ingest local prompt files via the --prompt-file flag.
Boundary markers: The instructions provide explicit warnings such as "Treat every finding as advisory" and "Verify it by reading the real code path."
Capability inventory: The agent can modify local files via clawpatch fix and execute arbitrary code via npm test or npm run typecheck.
Sanitization: The skill mitigates risks through mandatory manual code verification, git diff inspection, and strict prohibitions against automated commits or pushes.

jb-clawpatch-review