The Agent Skills Directory

[COMMAND_EXECUTION]: The core script scripts/autoreview orchestrates the execution of several external CLI tools such as git, gh, and various LLM agents including codex, claude, and opencode. It also includes a feature to run parallel test suites via shell commands, which is an intended functional capability for validating code changes alongside AI reviews.
[EXTERNAL_DOWNLOADS]: The skill interacts with remote AI services and can optionally perform web searches or fetches using the underlying agent binaries to retrieve external context such as documentation or dependency contracts.
[DATA_EXFILTRATION]: By design, the skill transmits code diffs and file content to external AI providers for processing. However, it incorporates a robust safety layer (file_bundle_risk and secret_text_risk) that identifies and blocks the inclusion of sensitive files (e.g., .env, SSH keys, cloud credentials) or patterns matching private keys and API tokens in the analysis bundle.
[PROMPT_INJECTION]: The tool is exposed to indirect prompt injection via the code it processes. This is mitigated through a multi-layered approach:
Ingestion points: Untrusted data enters via git diff and local file reads.
Boundary markers: The system prompt uses explicit 'Hard rules' and a 'Scope Governor' to instruct the model to ignore non-advisory content and stay within task boundaries.
Capability inventory: Review engines are invoked using high-isolation flags (e.g., --safe-mode, --ignore-user-config, and neutral temporary directories) to prevent them from loading project-local malicious configurations like MCP servers or project hooks.
Sanitization: Automated filtering prevents the exposure of high-risk data that could be used in secondary attacks.

autoreview