The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/review_scope.py and scripts/test_review_scope.py execute git commands via the subprocess.run function to perform repository analysis and testing. This is the intended behavior for the skill's purpose. The implementation uses list-based argument passing and avoids the use of shell=True, which is a safe practice that prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface for indirect prompt injection because its core function is to ingest and analyze untrusted external data in the form of code diffs and markdown-based review records.
Ingestion points: Data enters the agent's context through scripts/review_scope.py (reading git diff output) and scripts/review_record_check.py (parsing markdown files).
Boundary markers: The methodology includes extensive guidance for human triage of AI findings, but the automated scripts do not programmatically wrap the processed data in strict delimiters or warnings against embedded instructions.
Capability inventory: The skill has the capability to interact with the local filesystem and execute git commands through the subprocess module.
Sanitization: The scripts use deterministic parsing (regex and string manipulation) and safe subprocess execution patterns (no shell interpolation), which mitigates the risk of the input data triggering direct command execution, though it remains a surface for influencing the LLM's reasoning.

code-review