The Agent Skills Directory

[COMMAND_EXECUTION]: The skill and its test suite utilize subprocess.run to interact with external tools like Git and LLM engines (Codex/Claude). These operations are implemented with significant security controls, such as the fixture_git_binary check, which ensures only trusted, absolute paths from the system PATH are used, preventing the execution of binaries located within the potentially untrusted repository being reviewed.
[CREDENTIALS_UNSAFE]: Test fixtures in tests/fixtures/typescript-sensitive-literals.ts contain various hardcoded secret strings (e.g., GitHub and AWS tokens). These are explicitly identified as fake placeholders and are used as test data to verify the skill's ability to detect real credentials without reproducing or exfiltrating them.
[INDIRECT_PROMPT_INJECTION]: As its primary function is to review external code diffs, the skill naturally ingests untrusted data. It mitigates this risk by maintaining strict reviewer isolation and using dedicated sandboxes (verified via tests/test_codex_sandbox.py) to ensure that malicious instructions in the code being reviewed cannot influence the host agent or system.
[DYNAMIC_EXECUTION]: The unit tests use SourceFileLoader to load and execute the logic of the adjacent autoreview script. This is a standard testing pattern for Python CLI tools and is confined to the test environment.
[DYNAMIC_CONTEXT_INJECTION]: The skill documentation describes the dynamic context execution syntax (exclamation mark followed by backticks) for developer awareness but does not utilize it in a manner that performs unauthorized loads or executions.

autoreview