The Agent Skills Directory

[COMMAND_EXECUTION]: The autoreview script provides a --parallel-tests flag that allows the execution of arbitrary shell commands alongside the review process. It uses subprocess.Popen with shell=True to execute these user-provided strings. While a standard feature for this tool, it represents a mechanism for command execution if the agent is directed to run malicious tests.
[COMMAND_EXECUTION]: The skill includes a sophisticated binary resolution mechanism (find_command) that explicitly prevents the execution of binaries located within the repository being reviewed. This mitigates risks where an attacker might place a malicious git or gh executable in the codebase to gain execution when the review tool is run.
[DATA_EXFILTRATION]: The tool is designed to collect git diffs, file contents, and untracked files into a 'bundle' which is then transmitted to external AI service providers (such as OpenAI/Codex, Anthropic/Claude, and others). This transmission of code is the intended primary function of the skill.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads arbitrary code from the current repository and interpolates it directly into a prompt sent to an AI engine. Malicious instructions embedded in the code being reviewed could attempt to influence the AI's review verdict. The skill attempts to mitigate this using 'Hard rules' and instructional framing within the prompt template.
Ingestion points: Untracked files and git diffs are read by the local_bundle, branch_bundle, and commit_bundle functions in scripts/autoreview.
Boundary markers: The bundle is delimited by a # Change Bundle header within the final prompt.
Capability inventory: The skill can execute shell commands via the --parallel-tests feature and can trigger external AI CLI tools.
Sanitization: Content is truncated to a length limit but is not sanitized for prompt injection keywords or escape sequences.

code-review