The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands to validate the state of the project before initiating reviews. This includes using git rev-parse to determine the project root, git branch to identify the current branch slug, and jq to parse data from the bd task management tool. It also launches three independent background processes using opencode run to invoke external LLM analysis.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of untrusted local files into the context provided to sub-agents.
Ingestion points: The skill reads contents from CLAUDE.md, README.md, all files in .llmdocs/, and temporary plan files in .llmtmp/, as well as external 'plan documents' specified by the user in the plan metadata.
Boundary markers: Artifacts are concatenated into a context string using text-based delimiters such as === <path> === to distinguish between different files.
Capability inventory: Sub-agents invoked through opencode are granted the ability to perform tool calls, specifically to write review files back to the local file system.
Sanitization: There is no evidence of content filtering, escaping, or validation performed on the ingested files before they are included in the prompt context.
[DATA_EXFILTRATION]: The skill transmits project artifacts and documentation to external LLM providers (OpenAI, Google, and Anthropic). This behavior is consistent with the skill's stated purpose of leveraging multi-model consensus for deep reviews and involves well-known, established service providers.

ralph-review-deep