The Agent Skills Directory

[SAFE]: The skill provides a structured framework for code review based on senior-level engineering principles, utilizing static analysis techniques to evaluate user code.- [COMMAND_EXECUTION]: The skill executes a bundled shell script scripts/run-static-checks.sh to perform fast pattern matching on Kotlin source files. The script is a local utility that wraps standard tools like grep or ripgrep to search for anti-patterns (e.g., GlobalScope usage, force-unwraps, weak cryptography). The script contains appropriate quoting for variables and does not exhibit command injection vulnerabilities.- [INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill naturally processes untrusted data such as Kotlin source code and pull request metadata. While this represents a theoretical surface for indirect prompt injection via malicious code comments, the skill mitigates this through specific behavioral instructions that enforce a strict review persona and prioritize predefined security and architectural checks. Ingestion points include Kotlin source files, git diffs, and GitHub PR data. The capability inventory is limited to local file reading and execution of the provided static check script. The skill instructions also mandate the redaction of detected secrets from the final report.

kta-code-review