The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes common developer tools including git, gh, curl, node, and python3 to orchestrate parallel reviews, fetch repository data from NVIDIA's GitHub organization, and communicate with external review service APIs.
[PRIVILEGE_ESCALATION]: The skill uses the dangerouslyDisableSandbox flag for specific sub-agent calls involving the Codex and CodeRabbit CLIs. This is necessary to permit the tools to perform network operations and write to configuration/log directories in the user's home folder (~/.claude and ~/.coderabbit). These bypasses are narrowly scoped and preceded by environment probes to confirm necessity, ensuring no broader privilege escalation occurs.
[INDIRECT_PROMPT_INJECTION]: The skill manages the risks associated with processing untrusted code from pull requests through several mitigations:
Ingestion points: Processes PR diffs and file content via gh pr diff and git show (SKILL.md, workflow.mjs).
Boundary markers: Prompt templates include explicit NO_EXECUTION rules and instructions for agents to treat repository metadata files as data rather than instructions (workflow.mjs).
Capability inventory: While agents have access to shell and workflow tools, they are strictly prohibited from executing repository scripts or binaries.
Sanitization: The skill normalizes PR references and uses file-based inputs for GitHub API calls to prevent shell injection (SKILL.md).
[PERSISTENCE]: The skill includes maintenance logic that reaps temporary diff files, session-scoped git references, and stale worktrees older than a configured threshold (24 hours for general runs, 120 minutes for CodeRabbit worktrees). This is a legitimate cleanup mechanism for managing local session state.

aicr-cross-review