The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/pr_analyzer.py and scripts/review_report_generator.py scripts execute git commands and internal utility scripts using subprocess.run. These invocations use a list of arguments rather than a single shell string, which is a secure implementation that prevents shell injection vulnerabilities.
[DATA_EXPOSURE]: The tools are designed to detect security risks like hardcoded secrets and SQL injection patterns in the code they analyze. This is a primary function of the skill and is implemented through static regex-based scanning of local files. The skill does not perform any network operations to exfiltrate data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of source code and git diffs for analysis. While this represents an attack surface, the risk is mitigated by the fact that the analyzer performs static pattern matching and does not execute the code it analyzes. The generated reports are for human review and do not trigger automated actions that could be manipulated by malicious code content.

code-reviewer