The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Flow step 5) and references/review-dimensions.md (Packages, CLIs, configuration, CI section) direct the agent to execute code from the reviewed repository. Specifically, it suggests running reproduction scripts and dry-running or installing package artifacts. While intended for validation, this involves executing code from potentially untrusted sources.
[REMOTE_CODE_EXECUTION]: By advising the installation and execution of artifacts from the codebase being audited, the skill enables the execution of potentially malicious code (such as installation hooks or binaries) found in untrusted target repositories.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as it processes untrusted data (PRs, diffs, and project documentation) without boundary markers.
Ingestion points: Target repository files, diffs, pull requests, and authority documents (identified in SKILL.md and plan-backed-review.md).
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or specifically ignore instructions that might be embedded within the code comments or documentation of the reviewed target.
Capability inventory: The skill possesses capabilities for file system writes (.reviews/ directory), execution of shell commands (tests/repros), and delegation to subagents.
Sanitization: Absent. No instructions are provided to sanitize or validate the content before it is processed or executed.

code-review