The Agent Skills Directory

[COMMAND_EXECUTION]: Local command execution occurs in scripts/lib/input.mjs and scripts/lib/config.mjs to fetch git status, branch diffs, and pull request information using execFileSync. This implementation is safe because it passes arguments as distinct array elements rather than using a shell string, effectively avoiding shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The client component in scripts/lib/openrouter.mjs interacts with the OpenRouter API endpoint (openrouter.ai) using the native fetch API. This interaction is limited to a well-known tech service domain for downloading model metadata and sending completion payloads. It incorporates automated token redaction via a redact() function to minimize the risk of accidental log exposure.
[INDIRECT_PROMPT_INJECTION]: The skill presents an inherent indirect prompt injection risk surface due to the processing of untrusted content such as user-provided files or remote code repository diffs. However, the system is designed to minimize risk:
Ingestion points: Untrusted inputs are loaded into memory via scripts/lib/input.mjs when reading target repository items or pull requests.
Boundary markers: Structural separation is implemented via descriptive markdown headers like # Material under review and --- PR DIFF --- during prompt construction.
Capability inventory: The toolset contains no capabilities for dangerous runtime operations, local evaluation, or file-write execution on the fetched text content.
Sanitization: Content parsing relies on strict JSON schema validation via scripts/lib/schema.mjs, making it resilient to arbitrary instructions hidden inside incoming review strings.

ai-council-review