The Agent Skills Directory

Standard Command Execution: The skill provides instructions to execute standard development utilities such as npx tsc, npx eslint, and npx oxlint. These are used for type validation and linting of the codebase under review, which is a routine practice in software development.
Indirect Prompt Injection Surface: As a code analysis tool, the skill ingests untrusted code from external files and git history, creating a potential surface for indirect prompt injection. Ingestion points: Project source code, wrangler configuration files, and git log output. Boundary markers: The skill does not define explicit delimiters to separate code content from instructions. Capability inventory: Includes executing static analysis tools (tsc, eslint, oxlint), searching files with grep, and reading local file contents. Sanitization: No specific sanitization or filtering of the analyzed code is performed before processing. This is a security consideration inherent to tools that process external content.
Security Best Practice Guidance: The skill includes explicit rules to identify and flag potential vulnerabilities, such as hardcoded credentials and the use of weak cryptographic algorithms like MD5 or SHA-1.
Trusted Vendor Resources: The skill relies on official Cloudflare documentation and type definitions (e.g., @cloudflare/workers-types) to provide accurate reviews. These are recognized as legitimate resources provided by the platform vendor.

code-review