The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gerrit.py uses subprocess.run() to execute SSH commands for querying the Gerrit server. These are controlled executions using static command prefixes (ssh, gerrit, query) and validated arguments, posing no unexpected risk in the context of a developer tool.
[EXTERNAL_DOWNLOADS]: The documentation references official Gerrit and git-review resources for installation (pip install git-review) and configuration (fetching the commit-msg hook from the configured Gerrit server). These are standard practices for Gerrit workflows.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a Gerrit server (change subjects, owner names, comments) and formats it as markdown for the agent. While it ingests external data, it uses standard JSON parsing and lacks dangerous write-capabilities that could be triggered by such data.

gerrit