The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard development tools including git, gh (GitHub CLI), and glab (GitLab CLI) to fetch diffs and metadata. These are typical for its stated purpose and are performed within the local repository context.
[DATA_EXPOSURE]: The skill reads repository content, merge request descriptions, and commit logs. This data is written to a local report file (.scratch/reviews/) which is typically gitignored. No external data transmission of repository content is observed beyond the intended use of the platform CLI tools (gh and glab) to fetch public/accessible MR metadata.
[REMOTE_CODE_EXECUTION]: The skill uses sub-agents (Haiku models) for performance and design reviews. These agents are scoped by the primary session and operate under the same environment constraints. There is no evidence of downloading or executing arbitrary scripts from untrusted external URLs.
[PROMPT_INJECTION]: The skill includes instructions to the sub-agent that are purely instructional and do not attempt to bypass safety filters or override system-level instructions. The instructions focus on the review axes (Performance and Design) and grounding findings in evidence.
[SAFE_PRACTICE]: The skill explicitly instructs the agent to never post findings to the Merge Request/Pull Request automatically, requiring manual user approval for each comment to prevent spam or social friction. It also mandates leaving the user's local git state (stashes, commits) untouched, which is a defensive operational practice.

review-mr