The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to execute the project's full test suite and run the application itself (e.g., "Re-run everything yourself. Full suite, every contract assertion", "Run the app like a real (impatient) user for 10 minutes"). This behavior is essential to its function as a code reviewer but involves executing potentially untrusted code from the repository it is auditing.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes and acts upon untrusted data from project files and code diffs.
Ingestion points: The skill reads factory/HANDOFF.md, factory/progress.md, and the project's source code/diffs.
Boundary markers: There are no explicit markers or instructions to treat the reviewed content as untrusted data rather than instructions.
Capability inventory: The skill has file system access (reading code/metadata, writing factory/REVIEW.md and STATE.md) and shell command execution capabilities (running tests and project binaries).
Sanitization: No sanitization or validation of the content being reviewed is performed before it is processed or used to trigger commands.

factory-review