The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell command execution for its core workflow.
It uses git rev-parse and git log to collect repository metadata for report headers.
It executes date and mkdir to manage time-stamped review artifacts in the .reviews/ directory.
It calls platform-specific scripts located in ~/.claude/scripts/ to manage .gitignore settings and generate pull request deep links.
Command Injection Risk: The pr-deeplink.sh script is called with the $pr_url variable. If this URL is sourced from an untrusted external context (like a PR description or malicious git metadata), it could potentially be used for command injection if the execution environment does not strictly sanitize the variable before shell evaluation.
[PROMPT_INJECTION]: The skill's primary function is to analyze external implementation plans, creating an attack surface for indirect prompt injection.
Ingestion points: The skill reads implementation plans (.plans/*.md) and any referenced documentation such as CLAUDE.md or design documents provided by the user.
Boundary markers: Absent. The skill does not provide explicit instructions to the agent to treat content from plan files as untrusted or to isolate it from the skill's own logical instructions.
Capability inventory: The agent has the ability to read and write files, and execute shell commands (git, mkdir, date, grep, and custom local scripts).
Sanitization: There is no evidence of sanitization or validation of the content read from the plan files before it is processed by the agent or used in metadata headers.

review-plan