The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded fake credentials, including simulated OpenAI API keys, GitHub tokens, and AWS access keys, are present in tests/fixtures/typescript-sensitive-literals.ts. These strings are explicitly labeled as "FAKE" and serve as test data to verify the reviewer's ability to detect potential secrets in code.
[COMMAND_EXECUTION]: The skill executes external command-line tools, specifically git and the GitHub CLI (gh), via subprocess calls to retrieve repository state, diffs, and pull request information. This is a core requirement for the tool's stated purpose of reviewing code changes within a repository.
[DATA_EXFILTRATION]: The skill is designed to transmit source code diffs and repository metadata to external AI providers (such as OpenAI and Anthropic) for review analysis. The documentation explicitly acknowledges this transmission and advises that secret scanning should be handled by a separate process before code is sent for review.
[DYNAMIC_EXECUTION]: The testing framework uses runpy.run_path and SourceFileLoader in scripts/autoreview_test.py and other test files to dynamically load and verify the skill's modules. This execution is limited to the tool's verification process and uses standard Python introspection mechanisms.

autoreview