The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request metadata (titles, bodies, and comments) and git diffs, which serves as a potential vector for indirect prompt injection to influence the reviewer sub-agents.
Ingestion points: SKILL.md (Stage 1) utilizes gh pr view and git diff to gather external content for analysis.
Boundary markers: The skill employs structured templates (subagent-template.md) and specific delimiters (e.g., === BEGIN DIFF === in cross-model-adversarial-review.sh) to isolate untrusted data.
Capability inventory: Reviewer personas possess read-only access to the local filesystem and GitHub APIs. The orchestrator can apply suggested fixes in interactive mode.
Sanitization: PR comments and code changes are interpolated into prompts without explicit sanitization or filtering of potential instructional text.
[COMMAND_EXECUTION]: The skill utilizes vendor-supplied Python and shell scripts to manage task orchestration and cross-model AI testing.
Evidence: scripts/peer-job-runner.py manages detached process execution for sub-agents using subprocess.Popen, and scripts/cross-model-adversarial-review.sh invokes various AI CLI tools (e.g., codex, claude, grok). These executions are part of the intended functionality and include ownership checks for temporary files to mitigate multi-user risks.

code-review