The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/review_tool.py uses the subprocess.run function to execute multiple git commands.
Evidence: The function run_git in scripts/review_tool.py invokes subprocess.run(["git", "-C", repo, *args], capture_output=True).
Risk: Although shell=True is not used, the script performs file system operations based on repository paths and untracked file paths passed as command-line arguments by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the git repository (source code, diffs, and untracked files) which could contain malicious instructions designed to influence the agent's behavior during the review process.
Ingestion points: scripts/review_tool.py ingests data via git diff and direct file reads of untracked files (using Path.read_bytes).
Boundary markers: The widget template in assets/review-widget.html uses structured JSON inside a script tag and DOM APIs like textContent to render data safely in the browser. The verify subcommand in scripts/review_tool.py validates the schema of Base64-encoded payloads returned by the user.
Capability inventory: The skill has the capability to execute git commands and read/write files in the local workspace/scratchpad via scripts/review_tool.py.
Sanitization: The script uses html.escape within the wrap_page function in scripts/review_tool.py to sanitize metadata like the task title before embedding it in the HTML wrapper.

explained-diff-review