The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains several Python scripts in the scripts/ directory that use subprocess.call to invoke other internal scripts (e.g., convert_formats.py, parse_formats.py) for format conversion and parsing. Analysis of these scripts shows they use list-based arguments and do not invoke a shell (shell=True), which minimizes command injection risks. These scripts are intended for local artifact generation and template conversion during the skill's execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data such as PR diffs and repository names. It contains clear instructions to maintain boundaries, verify code identity, and avoid inventing findings based on verbal summaries. The prompts/code-review.md file specifically instructs the agent to replace real secrets with placeholders if they appear in examples, mitigating accidental data exposure.

code-review