The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local shell script scripts/changed-files.sh to determine the scope of files to review when no arguments are provided. This script runs standard Git commands (git rev-parse, git diff, git ls-files) and the GitHub CLI (gh pr view) to identify changes. The execution is scoped to the local repository and does not fetch from remote sources or execute unverified code.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it reads and processes source code comments which could contain malicious instructions. However, the skill implements strong mitigations:
Ingestion points: SKILL.md and references/reviewer.md specify that source files in the provided $ARGUMENTS scope are read.
Boundary markers: The skill uses a 'fresh-context' sub-agent for the review phase, effectively isolating the processing of untrusted content from the main agent's execution context.
Capability inventory: The reviewer sub-agent is explicitly restricted to read-only tools and is forbidden from writing files or executing commands. The primary agent only applies deletions automatically; functional changes (root-cause fixes or encoding constraints) require explicit user approval.
Sanitization: The reviewer's output must strictly follow a specific format (REMOVE, KEEP, ENCODE), and any deviation results in the report being rejected and the process stopping.

removing-comments