The Agent Skills Directory

Strong Operational Guardrails: The skill implements a 'security-first' approach by explicitly instructing the agent to treat all pull request content as untrusted and prohibiting the execution of any code from contributions before a security review is complete. These rules significantly reduce the risk of accidental exploitation during the review process.
Principle of Least Privilege: The instructions mandate a read-only workflow, strictly forbidding the agent from modifying code, documentation, or configuration. Furthermore, it prevents the agent from performing high-impact actions like approving pull requests or requesting changes, ensuring that all significant decisions remain under human control.
Indirect Prompt Injection Surface: As a code review tool, the skill is designed to ingest and analyze untrusted data, including pull request diffs, descriptions, and repository-specific guidance files like AGENTS.md. This represents a potential surface for indirect prompt injection where malicious instructions could be embedded in the code being reviewed to influence the agent's feedback. However, the skill mitigates this by instructing the agent to triage findings against the diff and surrounding code, and requiring human approval for findings in interactive sessions.
Controlled Output Environment: For interactive sessions, the skill requires findings to be returned as drafts for human approval rather than being posted directly. This human-in-the-loop mechanism provides a critical validation step to ensure the agent's output is appropriate and safe.

mcp-code-reviewer