The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to check for and potentially install the diffity package globally using npm install -g diffity. This introduces a dependency on an external third-party package not included in the trusted vendors list.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data into the agent's context.
Ingestion points: Data is read from diffity agent diff output and various CLAUDE.md files located in the repository.
Boundary markers: The instructions do not specify any delimiters or safety warnings to prevent the agent from following instructions embedded within the reviewed code or project rule files.
Capability inventory: The skill has the capability to execute CLI commands (diffity agent comment, diffity open) and read local files.
Sanitization: There is no mention of sanitizing or escaping the content retrieved from diffs or project files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill makes extensive use of the diffity CLI to perform its core functions. It executes commands such as diffity list --json, diffity agent diff, and diffity agent comment. While expected for the skill's purpose, it relies on the correct behavior of an external binary.

diffity-review