The Agent Skills Directory

[DYNAMIC_EXECUTION]: Static analysis flagged the presence of eval() and exec() in SKILL.md. These are included solely as 'BAD' code examples within the educational security guidelines to teach the agent which vulnerabilities to identify during code reviews. The accompanying scripts/security-scan.py uses the standard ast library for static analysis of these patterns and does not execute the code it scans.
[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted code from pull requests, creating a surface for indirect prompt injection via malicious comments. However, the skill provides specific delimiters for findings and lacks network exfiltration capabilities, which effectively mitigates the risk associated with this ingestion surface.
[COMMAND_EXECUTION]: The skill uses Bash(python:*) and Bash(npm:*) to run a local static analysis script and standard security auditing tools (pip-audit, npm audit). These operations are consistent with the skill's primary purpose of security auditing and follow secure patterns.

code-review-security