The Agent Skills Directory

[SAFE]: The skill is primarily educational and instructional, providing extensive documentation on best practices for code quality, architecture, and security across many tech stacks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external code changes (Pull Requests). It provides a Python script (scripts/pr-analyzer.py) and instructions to use the Bash tool for linting and testing.
Ingestion points: External source code and diff data from Pull Requests are read into the agent context via the Read tool and the analyzer script.
Boundary markers: The instructions do not define specific delimiters for separating untrusted code from the system prompt.
Capability inventory: The skill has access to Bash (shell execution), WebFetch (network), and Read (file access), which are necessary for its stated purpose of verifying code quality.
Sanitization: The provided Python script uses regular expressions for parsing diff content, which is a safe practice compared to dynamic execution. The documentation explicitly warns against common security vulnerabilities like SQL injection and XSS.
[REMOTE_CODE_EXECUTION]: No instances of remote script execution (e.g., curl | bash) or installation of unverified third-party dependencies were found. The Bash tool is reserved for standard linting and testing workflows.
[CREDENTIALS_UNSAFE]: No hardcoded API keys or secrets were detected. The documentation correctly advises developers to manage secrets via environment variables.

rightcode-code-review-excellence