The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process external, untrusted code deliveries (diffs, PRs, artifacts). This introduces a surface for indirect prompt injection where malicious instructions could be embedded in the code under review to influence the AI prosecutors or jury.
Ingestion points: Delivery artifacts, diffs, and PR content ingested at skill load time as defined in SKILL.md.
Boundary markers: The skill relies on its multi-stage adversarial protocol to filter defects, but explicit prompt-level delimiters for untrusted code are not detailed in the instructions to ensure the model disregards embedded commands.
Capability inventory: The skill spawns specialized review agents, executes shell commands via Bash, and interacts with external model providers through a ProviderManager.
Sanitization: No explicit sanitization or filtering of external code content is described before interpolation into reviewer prompts.
[COMMAND_EXECUTION]: The skill utilizes shell execution for running test suites and cross-vendor review tools.
Evidence: SKILL.md mentions running codex exec review via Bash and evals/qe-court.yaml executes npx vitest for oracle verification.
[EXTERNAL_DOWNLOADS]: The skill depends on external tools and well-known service providers for its review logic.
Evidence: The validation configuration in scripts/validate-config.json requires the jq utility, and evals/qe-court.yaml uses npx to run the vitest testing framework.
Evidence: The skill routes requests to well-known model providers including OpenAI, Gemini, and Claude (referenced via provider IDs in config.json).

qe-court