The Agent Skills Directory

[DATA_EXFILTRATION]: The skill collects project-specific information, including the contents of CLAUDE.md, development lessons stored in the .agents/lessons/ directory, and source code changes via git diff. This data is then passed as arguments to the codex and gemini command-line interfaces, which transmit the information to external third-party servers for processing. While this is the stated purpose of the skill, users should ensure they have permission to share this intellectual property with external providers.
[INDIRECT_PROMPT_INJECTION]: The skill incorporates untrusted content from the local filesystem (such as source code changes and project documentation) directly into prompts sent to external LLMs. If a file being reviewed contains malicious instructions (e.g., hidden in code comments), it could manipulate the external model's output.
Ingestion points: Content from CLAUDE.md, .agents/lessons/*.md, and the output of git diff commands.
Boundary markers: The skill uses simple string interpolation to build the prompt for the CLI execution without robust delimiters or instructions to the external model to ignore embedded commands.
Capability inventory: The skill executes codex exec and gemini CLI tools to process the gathered data.
Sanitization: No sanitization or filtering of the gathered file content or diff output is performed before transmission.
[EXTERNAL_DOWNLOADS]: The documentation instructs the user to install external CLI tools, specifically the @openai/codex package from the NPM registry and the Gemini CLI from Google. These are well-known services and trusted organizations.
[COMMAND_EXECUTION]: The skill relies on shell commands to gather project state (using git, cat, ls, and head) and then executes external binaries (codex and gemini) to perform the code review.

external-llm-review