The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through code diffs (git diff), specification files (docs/, specs/), and external review comments (review-comments.md).
Boundary markers: The skill employs logical separation into axes (Standards vs. Spec) and Markdown delimiters to structure the interaction, though it lacks strict technical sanitization for interpolating this data into prompts.
Capability inventory: The skill possesses the capability to execute shell commands (git, gh) and read/write to the local filesystem (e.g., using git worktree).
Sanitization: The skill mitigates injection risks by mandating that every finding be verified against the code ("Verify each finding before reporting it"), requiring citations for all claims, and prescribing a rigid output schema that separates findings by severity and axis.
[COMMAND_EXECUTION]: The skill utilizes local command-line tools to interact with the repository and pull requests.
Evidence: The SKILL.md and referenced documentation define workflows using git diff, git log, git blame, and the GitHub CLI (gh api).
Context: These commands are appropriate for a code review tool. The skill enforces a 'read-only' posture by instructing agents not to modify the branch or HEAD, instead using temporary worktrees for deep inspection, which limits the potential impact of command execution.

code-review