The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external code content via $ARGUMENTS and pull request diffs, which are interpolated directly into prompts for large language models to perform analysis.
Ingestion points: Code snippets provided in $ARGUMENTS and PR diffs retrieved in the CodeReviewOrchestrator Python script.
Boundary markers: The skill uses basic markdown headers like **Diff:** and **Modified Code:** to delineate ingested data. These markers are not robust against adversarial content within the code that might attempt to break out of the context.
Capability inventory: The skill can execute shell commands via subprocesses, access the local filesystem through tools like trufflehog, and perform network operations to GitHub and Anthropic APIs.
Sanitization: While the diff is truncated to 15,000 characters, there is no evidence of sanitization or escaping to prevent instructions embedded in the code from overriding the review logic.
[COMMAND_EXECUTION]: The skill instructions and sample scripts rely on executing local shell commands to perform static analysis.
Evidence: The CodeReviewOrchestrator class uses subprocess.run and subprocess.check_output to invoke sonar-scanner and semgrep. The GitHub Actions workflow also executes sonar-scanner, codeql, and semgrep commands.
[DATA_EXFILTRATION]: The skill's primary function involves transmitting potentially sensitive source code and analysis results to external AI providers.
Evidence: The Python script sends PR diffs and JSON-formatted static analysis results to the Anthropic API via the anthropic_client.messages.create method.
[METADATA_POISONING]: The skill contains deceptive references to unreleased or non-existent AI models in its description and configuration.
Evidence: The skill description and model selection sections repeatedly reference GPT-5, Claude 4.5 Sonnet, and Claude 4.5 Haiku, which can mislead users regarding the skill's actual operational environment and capabilities.

code-review-ai-ai-review