The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local git commands (git diff, git ls-files, git rev-parse) to identify changes in the working tree or between branches. It also executes a local vendor script scripts/resolve_base.sh to resolve the git base reference. These actions are consistent with its primary purpose as a code review tool.
[EXTERNAL_DOWNLOADS]: The skill's metadata references official Anthropics plugin repositories. No remote code execution or runtime downloads from untrusted sources were detected.
[DATA_EXFILTRATION]: The skill reads project-level and global rule files (CLAUDE.md, .claude/rules/*.md, ~/.claude/rules/*.md) and the project's source code. It allows saving reports to a local directory (~/.claude/output/). No network requests to external domains are made.
[PROMPT_INJECTION]: The skill defines stylistic "Writing rules" for its outputs and an "exclusion contract" that instructs the agent to defer security observations to specialized skills rather than reporting them directly. This design prevents the tool from being misused for out-of-scope tasks and maintains focus on its stated objective.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the git working tree and file contents, creating an attack surface for indirect prompt injection.
Ingestion points: Git diff output, contents of untracked files, and local rule files.
Boundary markers: The instructions mandate the use of "context-isolated" and "read-only" subagents for analysis, which mitigates the risk of an injection influencing the main agent's session.
Capability inventory: The skill possesses file-reading and git-execution capabilities. It does not have network access or arbitrary write permissions beyond its designated output path.
Sanitization: No explicit sanitization of input data is defined, as the skill relies on the agent platform's internal handling of tool outputs.

code-review