The Agent Skills Directory

Standard Command Execution: The skill uses the GitHub CLI (gh) and curl for legitimate repository operations. This includes fetching diffs, viewing PR metadata, and checking CI status. These are standard developer operations and do not involve unsanitized user input injection into the shell.
Anonymous Fallback Patterns: The skill explicitly instructs the agent to pivot to anonymous GitHub REST API calls using curl if gh authentication fails. This is a robust design choice to maintain functionality in restricted environments while targeting official api.github.com endpoints.
Sub-Agent Delegation: The skill delegates specific domain checks to a maui-expert-reviewer agent. This modular approach is part of its intended design for multi-dimensional code evaluation.
Safe Dependency Management: The skill does not automate the installation of external packages. It focuses on static analysis of existing code and PR metadata.
Dynamic Context Injection (Safe): While the skill's documentation references dynamic context injection (e.g., in metadata or platform-specific notes), the provided implementation does not execute arbitrary shell commands at load time for malicious purposes; rather, it uses them for standard dev-tooling integration like git or gh.

code-review