The Agent Skills Directory

[COMMAND_EXECUTION]: The wrapper script scripts/review.py executes git for repository analysis and the grok or claude binaries to perform the actual review. Commands are executed using subprocess.run() without the shell=True flag, minimizing shell injection risks. The script dynamically builds command lines for external CLIs using arguments derived from user input (e.g., --subject, --cwd).\n- [INDIRECT_PROMPT_INJECTION]: The skill's architecture is susceptible to indirect prompt injection because it processes untrusted data from a git repository. Ingestion points: File contents from the repository, including untracked files, are inlined into a prompt for the reviewer agent in scripts/review.py. Boundary markers: Weak markers are used in compose_prompt to separate instructions from the repository content. Capability inventory: The secondary reviewer agent is provided with read-only filesystem tools (read_file, grep, list_dir). Sanitization: Repository content is not sanitized or escaped before being processed.\n- [DATA_EXFILTRATION]: The script reads all untracked files in the repository and includes their content in the prompt sent to the LLM provider. This can lead to the exposure of sensitive data (such as secrets in .env files) if they are not explicitly gitignored or deleted prior to execution.

independent-review