The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions in SKILL.md explicitly direct the agent to request escalated permissions and run commands in an "unsandboxed" environment to facilitate access to OAuth tokens and local network ports.
[COMMAND_EXECUTION]: The skill executes a companion script (agy-companion.mjs) using node, as seen in SKILL.md, which serves as a shell for running a CLI tool with access to the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as pull requests, code repositories, and patch files.
Ingestion points: Reads content via gh pr view, git diff, and direct file reads as defined in references/code-review.md.
Boundary markers: SKILL.md mentions "guardrails" in a prompt template but acknowledges they may be bypassed by adversarial content.
Capability inventory: As per SKILL.md and its allowed-tools, the skill has access to Bash, git, and gh tools, and the companion can run arbitrary commands or tests in its default mode.
Sanitization: No specific sanitization or escaping of external content is described in the provided files before it is passed to the review tool.
[REMOTE_CODE_EXECUTION]: Documentation in SKILL.md warns that when reviewing untrusted content in the default "unrestricted" mode, prompt injection attacks could lead to the execution of arbitrary commands on the host system.

reviewer