The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the system git binary and user-configured codex or claude CLI tools to perform code reviews. \n
Evidence: The runGit, invokeCodex, and invokeClaude functions in scripts/agent-review.ts manage subprocess execution using Bun's spawnSync. \n
Control: The validateExternalPath function verifies that the review binaries are not located within the repository being reviewed, preventing the execution of malicious local tools. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content which could contain malicious instructions. \n
Ingestion points: collectScope and buildBundle in scripts/agent-review.ts read the git diff and file snapshots from the worktree or a commit. \n
Boundary markers: reviewerPrompt wraps the untrusted bundle in a random UUID-based delimiter (AGENT_REVIEW_BUNDLE_${crypto.randomUUID()}) to isolate it from the reviewer instructions. \n
Capability inventory: The skill calls git for repository state and codex/claude for review logic execution. \n
Sanitization: isSensitivePath filters out credentials and private keys from the ingested data set. \n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill minimizes the risk of sensitive data exposure by implementing a 'Sensitive Input Boundary'. \n
Evidence: The isSensitivePath function identifies and blocks files typically containing credentials, such as .env files, SSH private keys, and cloud provider configurations, from being included in the review bundle sent to external LLM providers. \n- [REMOTE_CODE_EXECUTION]: The skill prevents environment-based injection attacks when spawning subprocesses. \n
Evidence: The safeEnvironment function in scripts/agent-review.ts strips dangerous environment variables like NODE_OPTIONS, BASH_ENV, and GIT_CONFIG before executing system tools.

agent-review