The Agent Skills Directory

[SAFE]: The skill acts as a set of guidelines and structural contracts for delegating tasks between a main agent and specialized subagents (investigator, builder, reviewer). It does not contain executable code or instructions that bypass safety protocols.
[INDIRECT_PROMPT_INJECTION]: While the skill involves processing external data (code files and diffs) via subagents, it explicitly defines structured 'Output contracts' (e.g., `:
path:line — symbol — short note`) to minimize unstructured prose. This structured approach, combined with the inherited 'Auto-clarity' for security warnings mentioned in the instructions, serves as a boundary marker to reduce the impact of potential instructions hidden in processed data.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or sensitive environment variable harvesting patterns were detected. The mention of environment variables (CAVECREW_REVIEWER_MODEL, etc.) refers to legitimate user-side configuration for model selection.
[COMMAND_EXECUTION]: No unauthorized command execution patterns were found. The examples provided are for the user to set environment variables in their own shell environment.

cavecrew