The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local git commands and internal Python scripts to perform repository analysis.
The scripts/pr_analyzer.py file uses subprocess.run to call git diff. It uses a list of strings for the command arguments, which prevents shell-level command injection vulnerabilities.
The scripts/review_report_generator.py file coordinates the analysis by executing the other scripts in the package using sys.executable.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of source code files and git diffs.
Ingestion points: Source code files are read by scripts/code_quality_checker.py and git diffs are read by scripts/pr_analyzer.py from the local file system.
Boundary markers: There are no explicit markers or warnings in the analysis scripts to prevent an agent from potentially following instructions embedded in the analyzed code comments or strings.
Capability inventory: The skill has the capability to read any file in the specified repository path and execute local git commands.
Sanitization: No sanitization is applied to the content of the files before processing them with regular expressions for code quality metrics.

code-reviewer