The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses dynamic context injection (exclamation-backtick syntax) to execute a Python script at skill load time to initialize constraints. Evidence: !uv run python3 ${CLAUDE_SKILL_DIR}/../../scripts/load-constraints.py dev-review in SKILL.md.
[COMMAND_EXECUTION]: The skill employs shell hooks to run external Python scripts for validation and delegation gating before tool usage. Evidence: PreToolUse hooks in the YAML frontmatter of SKILL.md.
[COMMAND_EXECUTION]: The skill dynamically locates and executes a JavaScript file (codex-companion.mjs) from a calculated directory in the user's plugin cache. This behavior executes code that is external to the skill's own directory based on its presence on the local filesystem. Evidence: Shell logic in the 'Review Strategy Choice' section of SKILL.md.
[PROMPT_INJECTION]: The skill implements a parallel review workflow that processes untrusted code through AI subagents, which constitutes a surface for Indirect Prompt Injection. (1) Ingestion points: Git diff files generated by review-package.sh and stored in .planning/handoff/. (2) Boundary markers: Specialized prompts (references/security-reviewer.md, etc.) are used to define reviewer roles, but no explicit sanitization or delimiters are applied to the diff content. (3) Capability inventory: Subagents are restricted to a read-only toolset including Read, Glob, Grep, and Bash(read-only), which effectively mitigates the impact of potential injection. (4) Sanitization: No explicit filtering or validation of the ingested diff data is performed before it is analyzed by the subagents.

dev-review