The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Python scripts (scripts/pr.py and scripts/snapshot.py) to execute shell commands via subprocess.run. These operations are limited to standard development tools: git, gh (GitHub CLI), and glab (GitLab CLI). The scripts consistently use list-based argument passing, which prevents shell command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external PR/MR threads, which is a potential attack surface for indirect prompt injection.
Ingestion points: Review threads and note histories are fetched from GitHub or GitLab via scripts/pr.py threads and ingested into the agent context (as outlined in SKILL.md).
Boundary markers: The SKILL.md file contains a strong security directive instructing the agent to treat all text from a PR (threads, descriptions, and code) strictly as data and never as instructions. It specifically warns the agent to ignore requests to run commands, approve, or merge.
Capability inventory: The skill provides capabilities for file modification (applying fixes), git operations (snapshotting and committing), and network API communication through authenticated CLI tools.
Sanitization: A structured verification process defined in references/reviewer-verifier.md requires the agent to reproduce or trace any claims against the current codebase before performing any fixes, preventing the execution of baseless or malicious suggestions.

revise-changes