The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, including pull request comments, review threads, and issue tracker descriptions. To mitigate potential injection attacks, the orchestrator provides specific instructions to all sub-agent personas (e.g., in subagent-template.md and peer-constraints.md) to treat all input from the diff and PR as data to be analyzed rather than instructions to be followed. Additionally, any actionable outcomes like code fixes or PR comments are reviewed by the user in a final summary before being applied.
[DATA_EXFILTRATION]: The skill features a "Peer Review" capability that allows the code diff to be sent to external large language model CLIs (like Gemini or Grok). This functionality is strictly opt-in via a peer:<cli> argument or project configuration. The skill enforces a mandatory disclosure message informing the user that the diff will leave the local machine before any external call is made.
[COMMAND_EXECUTION]: The workflow involves executing local shell and Python scripts (review.sh, tickets.sh) provided within the skill package. These scripts are used for deterministic tasks like classifying diff signals and merging JSON findings from multiple reviewers. The skill also uses standard git and gh (GitHub CLI) commands for repository interaction, following a least-privilege approach where branch switching and mutation are avoided until the final user-approved stage.
[DYNAMIC_EXECUTION]: Complex logic for merging and validating findings is implemented using Python scripts embedded as heredocs within the shell scripts. This execution is limited to internal logic and does not incorporate untrusted input into the executable code paths.
[PRIVILEGE_ESCALATION]: The skill creates a local run directory in /tmp for storing intermediate artifacts. It defensively uses chmod 700 and umask 077 to ensure that these temporary findings and PR metadata are only accessible to the current user, preventing local data exposure to other users on the system.

scan