The Agent Skills Directory

[SAFE]: The skill implements a robust multi-agent orchestration pattern where a primary agent independently verifies every candidate finding from specialist sub-agents, ensuring that reports are evidence-backed and minimizing the risk of hallucinated or unverified issues.
[COMMAND_EXECUTION]: The skill instructs the agent to discover and run commands derived from the repository's configuration (e.g., bin/ci, Gemfile, and repository instructions) to perform checks. While common in development workflows, this creates a vector where a malicious repository could influence local command execution.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks because it is instructed to treat 'explicit repository instructions' as higher priority than its default profiles. An attacker could potentially embed malicious instructions within a repository's documentation or configuration files to manipulate the agent's review logic.
[EXTERNAL_DOWNLOADS]: The skill references standard Ruby on Rails security tools such as Brakeman, Bundler Audit, and importmap audit. These are well-known security scanners and their use in this context is standard practice for a code review tool.

team-code-review