The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python orchestrator script and GitHub Actions YAML contain commands that execute system processes.
The CodeReviewOrchestrator class in SKILL.md uses subprocess.run to execute sonar-scanner and subprocess.check_output for semgrep.
The sonar-scanner command interpolates the self.repo variable: f'-Dsonar.projectKey={self.repo}'. If the repository name is not sanitized, this could lead to command injection.
The GitHub Actions example executes sonar-scanner, codeql, and semgrep directly in a shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted code (the diff) using LLMs, which is a known attack surface.
Ingestion points: The $ARGUMENTS variable and the diff string passed to the ai_review method in SKILL.md.
Boundary markers: The Python prompt uses string interpolation (**Diff:** {diff}) but lacks explicit escaping or instruction-isolation delimiters to prevent the model from obeying instructions embedded within the code diff itself.
Capability inventory: The script has the capability to post review comments to the GitHub API and execute local shell commands via subprocess.
Sanitization: There is no evidence of sanitization or filtering for the code diff before it is sent to the LLM.
[CREDENTIALS_UNSAFE]: The skill explicitly references the use of sensitive API tokens.
The Python script accesses os.environ['GITHUB_TOKEN'] and os.environ['ANTHROPIC_API_KEY'].
The GitHub Actions YAML references ${{ secrets.OPENAI_API_KEY }}.
Note: This is documented as a standard practice for secret management (safe practice), but it highlights the skill's reliance on high-privilege credentials.

code-review-ai-ai-review