The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a vendor-provided CLI tool (qodo) for reading and writing notes, and performing administrative tasks. It includes specific guidance for locating and verifying the CLI executable on Windows systems, explicitly prohibiting the execution of shell wrappers (.cmd, .bat, .ps1) to prevent script hijacking.
[EXTERNAL_DOWNLOADS]: The skill describes procedures for updating the CLI and agent skills via official commands (qodo update, qodo agents update). These instructions include strong guardrails, such as prohibiting the switching of update origins and requiring explicit user approval for any plan application.
[INDIRECT_PROMPT_INJECTION]: The skill ingests PR and Development Track notes that may be authored by external parties or other agents. It mitigates potential injection risks by instructing the agent to treat these notes as context or evidence rather than authoritative instructions and to verify all claims against the repository's code.
[DYNAMIC_EXECUTION]: The skill supports the installation of agent capabilities through the qodo agents install command. This process is governed by vendor-provided plans and requires the agent to verify the affected installation scope with the user before proceeding.
[SAFE]: The skill follows security best practices by using structured argument files (--args-file) to pass data to tools, preventing shell injection. It also explicitly instructs the agent to honor host-level write gates and never to inspect secret stores or bypass authorization checks.

qodo-review-notes