The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx repomix in SKILL.md to process the codebase. This command downloads and executes the latest version of the repomix package from the npm registry. While repomix is a standard tool for creating LLM-friendly codebase snapshots, executing unversioned code from a remote registry introduces a dependency on external infrastructure.
[COMMAND_EXECUTION]: The skill executes shell commands (git, rm, mkdir, npx) in SKILL.md. It implements a path traversal check in Step 1 to ensure that the TARGET_PATH provided by the user does not escape the PROJECT_ROOT.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process the entire codebase, which may contain untrusted data, creating a surface for indirect prompt injection attacks against the review subagents.
Ingestion points: The repository content is packed into repomix.xml (Step 3) and attached to the agent context (Step 4) in SKILL.md.
Boundary markers: Instructions in Step 5 define specific focus areas for subagents, but SKILL.md does not specify the use of data delimiters or instructions to ignore content that mimics agent commands.
Capability inventory: The skill can execute shell commands via npx (Step 3) and write findings to the .llmtmp/ directory (Step 5/6) as defined in SKILL.md.
Sanitization: There is no evidence of content sanitization or filtering of the repository data in SKILL.md before it is passed to the subagents.

review-full