The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a helper script, scripts/triage.py, which executes standard git commands using subprocess.run to provide a summary of the changes being reviewed (e.g., diff size, file lists). This usage follows security best practices by passing arguments as a list rather than using shell=True.
[INDIRECT_PROMPT_INJECTION]: As a review tool, the skill processes untrusted content from code repositories (such as diffs and specifications). It explicitly addresses this attack surface by instructing the use of fresh-context subagents for its audit phases, which prevents malicious code comments or documentation from influencing the main agent's behavior.
[DYNAMIC_EXECUTION]: The skill workflow requires the AI agent to execute the repository's local test suites, formatters, and type-checkers. This execution is performed to verify the correctness of code changes and is a central, intended feature of the review process, conducted within the context of the project's own verified tooling.

moes