The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator script scripts/agent_review.py and its associated adapters execute external command-line interfaces (claude, codex, opencode) using subprocess.run.
Evidence: The skill constructs command arguments as lists and executes them without using a shell (shell=False), which prevents standard shell injection vulnerabilities.
Context: This is the core intended functionality of the skill, allowing it to leverage other agentic tools for code and plan review.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted data from the repository (e.g., code, diffs, or plans) directly into the prompt sent to the reviewer agent.
Ingestion points: Data is read from stdin in scripts/agent_review.py, which typically receives repository content selected by the host agent.
Boundary markers: The generated prompt uses text labels such as Review input: and New review input: to demarcate the untrusted content, though it lacks robust escaping or strictly enforced XML/JSON delimiters for the input section.
Capability inventory: The reviewer agents invoked (claude, codex, etc.) are high-capability tools that may have the ability to execute shell commands or modify files in the environment.
Sanitization: No specific filtering or sanitization is performed on the input content before it is sent to the reviewer agent.
Risk: A malicious file in a repository could contain instructions designed to hijack the reviewer agent's behavior during the review process.

agent-review