The Agent Skills Directory

[SAFE]: The skill implements a robust 4-phase code review methodology (UNDERSTAND, VERIFY, ASSESS, DOCUMENT) designed to improve code quality and security.
[COMMAND_EXECUTION]: The skill uses Bash and specific tools (Read, Grep, Glob) for legitimate analysis tasks such as reading changed files, finding callers, and running tests. These are standard operations for a code review agent.
[REMOTE_CODE_EXECUTION]: While the skill mentions running tests and a validation script (scripts/validate-review-output.py), these are presented as internal project tools for verifying the review process itself. The instructions do not involve downloading or executing code from untrusted external sources.
[DYNAMIC_EXECUTION]: The skill utilizes a deterministic schema validator script to ensure review output consistency. This is a local validation step and does not involve runtime compilation or unsafe deserialization of external data.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly addresses the risk of untrusted data (like PR descriptions or comments) by designating them as 'claims' that must be verified against actual code behavior rather than trusted. It includes a Phase 1 'Caller Tracing' step to identify how user-controlled input flows through the system.
[DATA_EXFILTRATION]: There are no network operations or file exfiltration patterns. The network-related instructions (Phase 3) are limited to evaluating vulnerabilities like SQLi/XSS in the code being reviewed, not performing network calls from the skill itself.

systematic-code-review