The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/snapshot.py) to capture the state of the Git repository before and after the review process. This script uses subprocess.run with argument lists (avoiding shell interpolation) to interact with the local git binary.
[COMMAND_EXECUTION]: The skill invokes external CLI tools (codex, claude) to perform the code review. These are established, well-known developer tools. The instructions explicitly warn against using eval or pasting repository text directly into shell commands to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes code, diffs, and untracked files which are external and potentially untrusted data. This content is passed to a reviewer model, creating an attack surface where malicious code could attempt to influence the reviewer's findings.
Ingestion points: Ingests repository content, diffs, and untracked file listings during the 'Prepare' and 'Review' phases (SKILL.md).
Boundary markers: Uses a dedicated prompt template (references/reviewer-prompt.md) to scope the reviewer model's task and enforce read-only constraints.
Capability inventory: The skill possesses capabilities for file system access (reading/writing to a temporary artifact directory) and shell command execution (git, python, and model CLIs).
Sanitization: The skill implements a mandatory 'Triage' phase where the agent is strictly instructed to verify every finding against the actual code, types, and invariants, which serves as a critical human-in-the-loop/agent-validation check against malicious or incorrect model outputs.

cross-review