The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data, specifically pull requests and code diffs. While the instructions define a strict output format and review criteria, they do not include explicit boundary markers (like XML tags or specific delimiters) to separate the reviewer's instructions from the code being reviewed. An attacker could potentially embed malicious instructions within code comments in a PR to influence the agent's review outcome. This is a common architectural risk for analysis skills and is handled by the model's base safety layers.
[SAFE]: All referenced documents and checklists (e.g., signals.md, rubric.md, quality-contract.md) are linked via relative local file paths within the skill's environment. There are no external downloads, remote script executions, or unverifiable third-party package dependencies.
[SAFE]: The skill does not attempt to access sensitive system files (e.g., SSH keys, AWS credentials) or environment variables. All logic is contained within markdown instructions and JSON evaluation sets.
[SAFE]: No obfuscation techniques, hidden commands, or dynamic context injections (e.g., shell execution via !command syntax) were found in the skill metadata or body.

common-code-review