The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to invoke the claude CLI using shell pipes: printf '%s' "$PROMPT" | claude -p. This pattern passes potentially untrusted content from the $PROMPT variable directly into a shell environment.
[DYNAMIC_EXECUTION]: To manage long-running review processes, the instructions recommend implementing a custom runner using Python's subprocess.Popen(start_new_session=True) and communicate(timeout=600). This pattern requires the agent to generate and execute Python code to manage process lifecycles and timeouts.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to have an external agent (Claude Fable) review repository contents. Malicious content within the files being reviewed (ingested via Read, Glob, or Grep) could influence the behavior of the sub-agent.
Ingestion points: Local repository files, diffs, and base commits are read into the context of the external CLI.
Boundary markers: The skill attempts to mitigate risks by using the --disallowedTools "Edit,Write,NotebookEdit" flag and including a verbatim text boundary: Read-only review. Do not edit files or run state-changing commands.
Capability inventory: The external process has access to Read, Glob, and Grep tools and inherits the host's shell capabilities unless restricted by the environment.
Sanitization: The skill mandates a verification step where the agent must check every material claim against the source files before reporting to the user.

fable-review