The Agent Skills Directory

[SAFE]: The skill is primarily instructional and contains no executable scripts, network requests, or external dependencies. It enforces a human-in-the-loop model by requiring user invocation and prohibiting autonomous actions like writing tests or updating pull requests.
[SAFE]: The 'Correctness hunt' and 'Standards' axes include proactive security checks, such as identifying hardcoded secrets in diffs and verifying identity/ownership checks on public API mutations (e.g., 'trust the server' principle).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to process untrusted external data such as code diffs, ticket descriptions, and PR discussions.
Ingestion points: Identified in SKILL.md, where the agent reads the "shipped diff," "named PR, ticket, and their available discussion," and "Relevant repository code."
Boundary markers: The skill instructions mandate the use of a "review output fence" to delimit findings and tables, providing structure to the agent's output.
Capability inventory: The skill has no dangerous capabilities; doctrine.md explicitly forbids writing to files, updating trackers, or invoking external test tools. It only generates descriptive analysis for the user.
Sanitization: Instructions require findings to be "evidence-backed," "factual," and written in "plain language," which discourages the agent from repeating or obeying malicious instructions found within the diffs.

code-review