The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external CLI tools via Python's subprocess module to perform repository operations.
Evidence: scripts/_review_common.py and scripts/post_review.py use subprocess.run to call git (clone, fetch, diff, ls-tree) and gh (GitHub API access).
Context: Command arguments are constructed using validated inputs, such as commit SHAs checked against hex-format regular expressions and repository IDs matched against a predefined whitelist of hubs.
[EXTERNAL_DOWNLOADS]: The skill downloads content from external GitHub repositories to perform reviews.
Evidence: scripts/_review_common.py uses git clone to fetch plugin source code from repositories specified in PR manifests.
Context: These downloads are necessary for the primary function of the skill and target well-known services (GitHub).
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted code and manifests.
Ingestion points: The skill reads plugin manifest XML files and checks out entire source code repositories from GitHub during the preparation process defined in scripts/_review_common.py.
Boundary markers: The skill implements a 'post control' mechanism where the agent generates a preview (comment.preview.md) and must wait for an explicit confirm response from the user before executing scripts/post_review.py.
Capability inventory: The skill can read and write files in the ~/.se-dev/reviews/ directory and interact with the GitHub API using the user's authenticated credentials.
Sanitization: The instructions in SKILL.md and ReviewPolicy.md explicitly direct the agent not to trust PR descriptions or external summaries and to perform independent manual review of all in-scope changes.

se-dev-plugin-review