The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js utility script (render.cjs) to compile findings into an HTML report. It also uses platform-specific commands such as open, xdg-open, or cmd /c start to automatically display the generated report to the user.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a diagnostic tool that processes untrusted source code and test files. This creates a surface for indirect prompt injection where adversarial code could attempt to manipulate the agent's analysis. However, the associated rendering script (render.cjs) includes robust HTML escaping and uses DOM APIs (rather than innerHTML) to prevent Cross-Site Scripting (XSS) in the generated report.\n- [SAFE]: The skill adheres to a strict read-only policy for the project's source and configuration files. Its only write operation is the creation of a diagnostic report within a local .review-tests/ directory, which is automatically added to .gitignore to prevent accidental commits.

review-tests