The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The compatibility documentation includes an installation command for the Cursor Agent CLI using curl https://cursor.com/install -fsS | bash, which fetches and executes a script from the official Cursor website.
[COMMAND_EXECUTION]: The skill executes several shell commands to manage temporary directories and run external CLI tools (agent, claude, codex) with arguments containing repository data gathered from git and local files.
[PROMPT_INJECTION]: The workflow is susceptible to indirect prompt injection as it incorporates untrusted data from git diffs and file contents into prompts processed by AI models.
Ingestion points: Git diffs and file contents are read from the repository and combined with a prompt template to create review.md.
Boundary markers: The assets/code-review-prompt-template.md uses Markdown headers to structure the prompt and includes a warning to the agent not to follow the template instructions itself. However, it lacks explicit markers or instructions to the reviewer model to ignore potentially malicious instructions embedded within the untrusted code content being reviewed.
Capability inventory: The skill uses powerful agentic CLIs (agent, claude, codex) that have access to the local workspace and network, creating a potential path for malicious diff content to influence the environment via the model's output.
Sanitization: There is no sanitization or escaping of the diff or file contents before they are interpolated into the prompt sent to the models.

multi-model-code-review