The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository being reviewed through git diff and grep commands (e.g., in SKILL.md Step 1 and 2). This data is used to identify technology stacks and is processed by the agent during the review. However, the skill includes a specific review-verification-protocol.md that requires the agent to verify all findings against the actual source code and search for references, which mitigates the risk of being misled by maliciously crafted code or comments.
Ingestion points: File identification and technology detection steps in SKILL.md and technological sub-skills.
Boundary markers: The references/review-verification-protocol.md explicitly instructs the agent to echo artifacts and verify context before reporting findings.
Capability inventory: Execution of local shell commands (git, grep, go build, go test, golangci-lint) and file read operations.
Sanitization: The agent is guided by strict verification gates (Read, Reference, Upstream, Severity) to validate findings.
[COMMAND_EXECUTION]: The skill utilizes standard Go development tools and version control commands to perform its primary function of code review. These commands (go build, go vet, go test, git diff) are restricted to the local repository context and represent standard developer workflows.
[SAFE]: The skill references and analyzes well-known, trusted Go libraries such as charmbracelet/bubbletea, prometheus/client_golang, and jackc/pgx. No network exfiltration, credential theft, or persistence mechanisms were found.

do-review-go