The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted input in the form of plan documents and code diffs, creating a surface for indirect prompt injection attacks where malicious code could influence the reviewer's behavior.
Ingestion points: The skill reads the content of Strikethroo plans and repository code diffs (generated via git diff) as specified in the Operating Procedure of SKILL.md and implemented in scripts/code-review.cjs.
Boundary markers: The reviewer prompt constructed in scripts/code-review.cjs uses <<<BEGIN CUMULATIVE DIFF>>> and <<<END CUMULATIVE DIFF>>> to delimit untrusted code changes. It also utilizes a randomly generated deliveryToken and specific delimiters to prevent the agent from spoofing the XML findings document.
Capability inventory: The skill possesses the capability to execute shell commands (git, xmllint) via execSync/spawn and dispatch complex prompts to other AI harnesses such as claude, gemini, and copilot.
Sanitization: Input data from the diff and plan is interpolated into prompts without extensive sanitization beyond basic character escaping and ANSI code removal.
[COMMAND_EXECUTION]: The skill programmatically executes multiple external CLI tools to perform its core functions, including version control operations and AI harness orchestration.
Evidence: scripts/code-review.cjs uses child_process.execSync and spawn to run git (for diffing and attribute checking), xmllint (for XML schema validation), and various AI harness adapters (claude, codex, cursor-agent, gemini, copilot, opencode). The command construction uses JSON.stringify and argument arrays to mitigate basic command injection risks.

st-code-review