The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the ocr CLI tool, which accepts user-controlled inputs such as commit SHAs, branch names, and business context strings. While these are functional requirements, they represent a surface for command-based manipulation.\n- [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to access and manage ~/.opencodereview/config.json. This file is documented within the skill as containing the auth_token for LLM access. Guiding an agent to read or modify a file containing sensitive API keys creates a risk of credential exposure or accidental exfiltration.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted external data.\n
Ingestion points: The agent reads Git diffs (staged, unstaged, and untracked files) and project-level .opencodereview/rule.json files.\n
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore embedded instructions within the code being reviewed.\n
Capability inventory: The agent executes the ocr tool and is further instructed to "interpret findings" and "apply fixes," which involves the ability to write to the file system.\n
Sanitization: None identified. Malicious instructions embedded in code comments or rule files could be interpreted by the agent during the remediation phase.

ocr