The Agent Skills Directory

[COMMAND_EXECUTION]: The wrapper script scripts/gerrit.py uses subprocess.run to execute Gerrit SSH commands. While it passes arguments as a list to mitigate local shell injection, the ssh command itself involves external connectivity based on user configuration.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the git-review package. Additionally, the troubleshooting documentation (references/troubleshooting.md) includes instructions to download a Gerrit commit-msg hook script via curl from a user-specified remote host.
[DATA_EXFILTRATION]: The script scripts/gerrit.py performs network requests using urllib.request to fetch unified diffs from Gerrit REST API endpoints. These requests target user-defined Gerrit hosts which are outside of whitelisted domains.
[PROMPT_INJECTION]: The skill processes and displays external data from Gerrit servers, including change descriptions, reviewer comments, and code diffs. This ingestion of untrusted content into the agent context constitutes a surface for indirect prompt injection. \n
Ingestion points: Data enters the context via run_gerrit_query (SSH) and fetch_change_diff (HTTP) in scripts/gerrit.py. \n
Boundary markers: The output uses markdown formatting (headers, lists) but lacks explicit delimiters or instructions for the agent to ignore embedded commands in the Gerrit data. \n
Capability inventory: The skill possesses the ability to execute shell commands and perform network operations. \n
Sanitization: The script truncates review comments to 200 characters but does not sanitize or escape potential markdown or instruction-like content.

gerrit