The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses the npx utility to download and execute the acpx package from the official npm registry at runtime. This tool is used as a transport layer for communication with external AI agents using the Agent Client Protocol.
[DATA_EXFILTRATION]: As part of its 'cross-model review' functionality, the skill transmits the source code diff to external AI providers, including Anthropic, OpenAI, Google, and xAI. This is a core, documented feature designed to provide independent corroboration of findings. The skill requires users to authorize this behavior through the invocation of the skill and provides clear announcements before data egress.
[COMMAND_EXECUTION]: Several bundled Python and Bash scripts use subprocess and Popen to perform repository inspections (git commands), system status checks (ps), and to manage detached worker processes. The peer-job-runner.py script specifically manages the lifecycle of these background review tasks, including logic for reaping processes and enforcing timeouts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code diffs and incorporates them into prompts for AI subagents. It mitigates injection risks by using nonce-delimited blocks (e.g., === BEGIN DIFF <nonce> ===) and explicit instructions to the agents to treat the content as data rather than instructions.

ce-code-review