The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill aggregates potentially untrusted data from the repository (file contents, diffs, and history) into a 'brief' sent to an external model. This creates an attack surface where malicious files in a repository could attempt to influence the delegated reviewer.
Ingestion points: SKILL.md describes gathering 'artefact: paths, relevant excerpts, base commit or range' and 'untracked files' to build the review brief.
Boundary markers: The skill requires including a verbatim 'Read-only review' boundary in every brief to instruct the model not to attempt changes.
Capability inventory: The skill interacts with the filesystem via CLI tools like claude, codex, and muse. In references/claude.md, capabilities are restricted to 'Read, Glob, Grep'.
Sanitization: The skill relies on platform-level sandboxing (e.g., --sandbox read-only in Codex or --disable-write in Muse) to enforce security rather than performing input sanitization.
[COMMAND_EXECUTION]: The skill's primary function is the execution of external CLI processes. It includes a specialized 'references/process.md' guide that provides a Python implementation for executing these tools safely using subprocess.Popen with process groups and hard timeouts (1800s). The guide explicitly warns against shell interpolation to prevent command injection.

review