The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions and templates for the agent to execute various command-line tools, including git, npm, agent (Cursor), codex (OpenAI), claude (Anthropic), and muse. It also includes several Python utility scripts (capture_dispatch_result.py, attest_file.py) that wrap shell operations like git status using safe subprocess.run patterns (passing arguments as lists rather than raw strings). These operations are well-documented and are the primary intended function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as code diffs and specification documents (SPEC.md). The following evidence chain documents the security posture:
Ingestion points: External content is ingested in workflow-steps.md (Step 6), where reviewers are instructed to read the project's diff and spec file.
Boundary markers: The confirm-round-protocol.md (§ Scope) establishes strict boundaries, instructing agents to ignore findings outside of the specific fix lines to prevent adversarial or irrelevant instructions from influencing the loop.
Capability inventory: The orchestrator has capabilities to write files, perform git commits, and dispatch multiple secondary agents (Cursor, Codex, Claude).
Sanitization: The protocol requires the orchestrator to independently reproduce every claimed finding using minimal probes (confirm-round-protocol.md § Repro-before-fix) before incorporating them into a fix brief, effectively filtering out hallucinatory or malicious claims from processed data.
[EXTERNAL_DOWNLOADS]: The skill includes instructions to install the @openai/codex package from the NPM registry. This reference targets a well-known service from a trusted technology provider (OpenAI) and is documented neutrally as a prerequisite for the review stage.

review-commit