The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the 'codex' CLI tool through shell scripts and Python's subprocess.Popen interface. This involves running system commands with user-defined or repository-derived parameters, such as the repository path ($REPO) and output file paths ($OUT).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted repository data (such as code diffs, logs, and file content) by passing it to an external LLM ('gpt-6-astra') within a review brief. This creates a surface for indirect prompt injection if the repository content contains malicious instructions intended to influence the agent's behavior during the review process.
Ingestion points: The 'brief.md' file, which aggregates data from the repository under review, including file contents and git history (SKILL.md).
Boundary markers: The skill includes a specific boundary instruction for the brief: 'Read-only review. Do not edit files or run state-changing commands.' (SKILL.md).
Capability inventory: The skill utilizes codex exec for sandboxed shell execution and Python subprocess.Popen for managing the review process. It also directs the agent to rerun commands to verify findings (SKILL.md).
Sanitization: Security measures include a mandatory 'sandbox check' to confirm write-protections are active, parsing structured JSON events instead of raw text, and a policy requiring human-in-the-loop verification of every claim against the source code (SKILL.md).

astra-review