The Agent Skills Directory

[SAFE]: The skill implements a strictly non-mutating review methodology. It explicitly forbids the execution of deployments, migrations, auto-formatters, or any commands that modify the state of the reviewed artifacts.
[SAFE]: Extensive guidance is provided across 14 stack-specific and 7 framework-specific reference files to identify and escalate security risks like credential exposure, authentication gaps, and privilege escalation in the target code.
[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external data (source code, pull requests, and diffs), which is a known vector for indirect prompt injection.
Ingestion points: Artifacts provided for review (Plain or Pull request review types).
Boundary markers: No specific delimiters or "ignore previous instruction" wrappers are defined in the skill instructions for the ingested data.
Capability inventory: The agent is authorized to use non-mutating repository tools like go vet, clippy, tsc, and lint to verify findings.
Sanitization: The skill includes a requirement for an "adversarial evidence check" before reporting findings, which serves as a validation layer for the agent's conclusions.

nerd-review