The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses multiple shell commands for repository discovery, baseline checks, and automation, including 'git', 'rg', 'mkdir', and various 'npm' lifecycle scripts (lint, test, build).
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use the '--dangerously-skip-permissions' flag with the Claude Code CLI. This flag is designed to bypass the tool's internal safety checkpoints and user permission prompts, which significantly increases the risk if the CLI is influenced by malicious repository content during the autonomous review loop.
[COMMAND_EXECUTION]: To verify aliases, the skill uses 'zsh -ic 'type '', which spawns an interactive shell and executes user-provided configuration files, potentially executing unknown code in the user's environment.
[DATA_EXFILTRATION]: Repository analysis reports containing potentially sensitive architectural and logic details are saved to a temporary directory ('/tmp/claude-code-review-...'). This places sensitive findings in a location that may be accessible to other local users or processes on the system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon reports generated by an external CLI (Claude Code) which scans potentially untrusted repository content. Malicious content in the codebase could manipulate the reports to trick the agent into applying harmful code changes or commits. \n
Ingestion points: External reports generated from repository content and stored in '/tmp/'. \n
Boundary markers: No explicit delimiters are used to separate the report content from instructions during processing. \n
Capability inventory: File writing, command execution (npm scripts), and version control operations (git commit). \n
Sanitization: The skill relies on manual 'triage' instructions for the agent to validate findings, but lacks technical sanitization or integrity checks for the generated report content.

mj-claude-code-review-loop