The Agent Skills Directory

Local Write Boundary: The skill defines a strict behavioral sandbox in SKILL.md, restricting all file creation, updates, and deletions to a specific .copilot-tracking/ directory. This protocol ensures that the source code repository remains read-only during the review process, preventing unintended or malicious modifications to the codebase.
Human-in-the-Loop Confirmation Gates: According to references/emission-modes.md, all interactive review paths require explicit human confirmation before findings are emitted. The workflow generates a local draft (review.md) and requires the user to check specific authorization boxes before any comments are posted to external platforms like GitHub, GitLab, or Azure DevOps.
Register Separation Protocol: The skill utilizes a two-register system to manage analysis context as described in references/walkthrough-protocol.md. By separating factual orientation (Register 1) from structured finding generation (Register 2), the skill reduces the surface area for indirect prompt injection, where malicious instructions inside a code diff might attempt to influence the reviewer's verdict.
PR State Validation: The emission logic includes checks to verify that the target pull request is still open and that the head SHA matches the reviewed code before posting. This prevents the emission of stale findings or comments on modified code, maintaining the integrity of the review history.
Secure Orchestration: The skill facilitates handoffs to specialist agents (e.g., Security Reviewer, SSSC Reviewer) within the trusted vendor ecosystem. It uses capability-gated checks to ensure these extensions are only offered if the appropriate tools and signals are present in the current environment.

code-review