The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to run commands 'unsandboxed' and to 'request escalated permissions'. This is documented as a requirement for the companion tool to access a localhost port and an OAuth token file, which are necessary for authentication with Google services but bypass standard security sandboxing.
[COMMAND_EXECUTION]: The skill executes a companion script (agy-companion.mjs) using the node runtime. It also utilizes system CLI tools such as git and gh (GitHub CLI) to fetch code diffs, pull request metadata, and commit logs for analysis.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from external sources, including pull requests from unknown authors and patch files. The instructions acknowledge that prompt injection within this content could lead to arbitrary command execution when the skill is run with an unrestricted permission profile.
Ingestion points: The skill fetches data via gh pr view, gh pr diff, git diff, and direct file reads as described in references/code-review.md.
Boundary markers: Uses specific task framing and 'flavor' contracts (code vs. general review) to scope the AI's behavior, though it notes these can be bypassed by injection in untrusted content.
Capability inventory: The skill can execute shell commands via node, git, and gh, and accesses local network ports and credential files.
Sanitization: No explicit sanitization or escaping of the ingested data is described in the provided files; the skill relies on the companion tool's internal guardrails.

agy-reviewer