The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands to invoke external review tools like the Codex or Gemini CLIs. It passes the raw content of the code diff directly into the command string (e.g., codex exec "... <diff>"). If the diff contains shell metacharacters such as backticks or semicolons, it could lead to arbitrary command execution on the host system when the agent attempts to perform the review.
[REMOTE_CODE_EXECUTION]: The skill is designed to execute arbitrary shell commands provided by the agent or user for the purpose of running test suites, linters, and build processes. While this is the intended functionality of a development auditor, it provides a powerful primitive for local code execution.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from repository code diffs and project specification files (like spec.md or plan.md) and passing them to sub-agents for review.
Ingestion points: Git diffs of uncommitted changes and project planning/specification files (SKILL.md).
Boundary markers: The skill recommends using a text-based boundary line (e.g., "Review only the diff below") but does not employ robust delimiters or formal sanitization to prevent injected content from escaping the intended context.
Capability inventory: The skill can execute shell commands (test, lint, build), commit code to the repository, and draft pull requests.
Sanitization: There is no evidence of escaping, filtering, or validation of the diff content or spec files before they are interpolated into instructions for the sub-agents or external model CLIs.

done