The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external data, specifically code diffs, pull request bodies, and issue comments, creating a vulnerability surface for indirect prompt injection. A malicious actor could embed instructions within a PR or code comment to influence the agent's behavior.
Ingestion points: Local branch diffs, GitHub PR diffs, pull request bodies, commit messages, and previous review threads (identified in SKILL.md and contract.md).
Boundary markers: The instructions mandate the use of specific output formats, such as the 'review output' fence and a structured Spec matrix, to separate code content from analysis results.
Capability inventory: The agent can execute shell commands for static analysis (static-checks.md) and interact with the GitHub API using tools like gh (reference.md).
Sanitization: No specific content sanitization or character escaping of the analyzed diffs is described; however, the agent is instructed to focus strictly on evidence-backed findings and predefined axes.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands to perform mechanical quality checks. This includes running npx knip for dead code detection and npx eslint to calculate cyclomatic complexity. It also suggests running language-specific tools like vulture, radon, staticcheck, and gocyclo for Python and Go projects. Additionally, it uses the GitHub CLI (gh) to fetch and post pull request data.
[DATA_EXFILTRATION]: The skill is instructed to access and audit environment configuration files (.env, .env.example, etc.) to detect environment variable synonyms and ensure architectural consistency (doctrine.md). While these files frequently contain sensitive information, the access is scoped to the analysis of variable names as part of a code quality audit, rather than harvesting their values for external transmission.

review