The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill dynamically constructs and executes a JavaScript script via the platform's Workflow tool in context/run-everything-mode.md. This script handles the parallelization of review tasks and uses string substitution to inject configuration into the executable JS code.
[PROMPT_INJECTION]: The skill implements a multi-stage review and fix pipeline that ingests and processes data from external reviewer 'surfaces', including third-party models. This introduces a potential surface for indirect prompt injection, where malicious instructions embedded in a code diff or pull request could influence the generated findings and the subsequent automated fixes performed by the fix action.
[COMMAND_EXECUTION]: The SKILL.md uses dynamic context injection (!command`` syntax) to execute several shell commands at load time. These commands fetch current branch info, working tree status, and open pull requests using standard developer tools like git and gh. While benign and restricted to local metadata, this represents the execution of shell commands when the skill is accessed.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services, specifically referencing the OpenAI Codex plugin (codex@openai-codex) to provide cross-vendor review breadth. This involves sending code diffs and metadata to a well-known external model service as part of its intended functionality.

fanout