The Agent Skills Directory

[PROMPT_INJECTION]: The skill's instructions were analyzed for prompt injection vulnerabilities. No instructions were found that attempt to bypass safety filters or override the agent's core behaviors. While the skill processes untrusted artifact data which could contain indirect prompt injections, its primary function is to identify and surface such issues via its internal red-teaming loop.
[DATA_EXFILTRATION]: Evaluated the skill for data exposure risks. The 'External Model Review' and 'Consensus Bridge' features use MCP tools to send artifact context to external models for analysis. This is a transparently documented capability designed to provide broader review coverage and is considered a core function of the skill. No unauthorized transmission of credentials, environment variables, or sensitive system files was detected.
[EXTERNAL_DOWNLOADS]: No direct external downloads or remote script executions (such as piped curl-to-bash commands) were identified. The skill relies on pre-configured sub-skills and platform tools. Its internal 'Security Surface Detection' heuristic is specifically designed to flag such patterns as high-risk within the artifacts it audits.
[INDIRECT_PROMPT_INJECTION]: The skill provides a significant surface for indirect prompt injection by ingesting untrusted artifacts and interpolating them into sub-agent prompts. However, the orchestrator includes 'Artifact Preparation' steps (such as stripping revision marks or comments) and uses distinct sub-agents with specific rubrics to mitigate the impact of malicious content in artifacts.
[COMMAND_EXECUTION]: The orchestrator manages sub-agents (e.g., the 'Fix Agent') that perform file edits and may run tests. This behavior is scoped to the remediation tasks and is an intended part of the quality gate process. The orchestrator itself does not perform direct or arbitrary shell command execution.
[DYNAMIC_EXECUTION]: The skill manages dynamic review state, writing JSON-formatted convergence logs and markdown verdict markers to a persistent directory (~/.claude/). This is a standard and necessary behavior for a multi-round orchestration system to support state recovery and telemetry. No unsafe deserialization or dynamic code loading from untrusted sources was found.

quality-gate