The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from PR descriptions, comments, and code diffs. This represents a potential indirect prompt injection surface.
Ingestion points: PR metadata fetched via gh pr view (Stage 1) and diff content fetched via git diff or gh pr diff (Stage 1), along with plan files (Stage 2b).
Boundary markers: The skill consistently uses XML-style tags (e.g., <pr-context>, <review-context>, <diff>) as defined in references/subagent-template.md to encapsulate untrusted data when passing it to sub-agent personas.
Capability inventory: The agent has shell access (Bash) and file system access (Read, Write, Glob) to perform reviews, create artifacts in /tmp, and apply local fixes.
Sanitization: The skill employs a multi-agent consensus model and a formal validation stage (Stage 5b) where findings are re-verified by independent sub-agents, significantly reducing the risk of malicious input influencing the agent's behavior.
[COMMAND_EXECUTION]: The skill makes extensive use of standard development tools (git, gh) to perform its primary function. All command invocations are structured and strictly related to the stated purpose of code review, such as checking branch state, fetching PR data, and applying local commits.

ce-code-review