The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell pipeline to sanitize user-provided session names ($ARGUMENTS). This interpolation of user-controlled input into a shell command string represents a potential command injection surface if the underlying platform does not provide strict argument escaping.
[COMMAND_EXECUTION]: The agent is instructed to automatically detect and run project-specific build and test tools (e.g., npm, cargo, go, make, pytest). While this is the intended purpose of the skill, it involves executing arbitrary commands defined within the project's configuration files.
[COMMAND_EXECUTION]: Phase 2 involves executing shell scripts (pack.sh, render-prompt.sh) from a local directory (.chalk/reviews/scripts/). These scripts are created dynamically by a separate skill (/create-review), creating an execution chain where the agent runs locally-generated script files.
[PROMPT_INJECTION]: The skill ingests and parses external findings files (*.findings.md) which may contain instructions generated by external AI models. This introduces an indirect prompt injection surface where malicious findings could attempt to influence the agent's code-fixing behavior.
Ingestion points: Reads *.findings.md files from the .chalk/reviews/sessions/ directory.
Boundary markers: The skill lacks explicit instructions for the agent to ignore natural language instructions embedded within the findings data.
Capability inventory: The agent has access to Edit, Bash, Write, and Read tools, which are used to apply the fixes.
Sanitization: The skill implements significant mitigations, including strict validation of file paths to prevent traversal and a mandatory 'ask for confirmation' step before the Edit tool is used to apply any proposed fixes.

review-changes