The Agent Skills Directory

[SAFE]: The skill instructions encourage security best practices by explicitly ordering the agent to prioritize 'blocking issues (breaks, security)' when implementing feedback. It also discourages performative agreement, reducing the likelihood of the agent blindly following potentially harmful suggestions.- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external, untrusted data (code review feedback). This is identified as a vulnerability surface because the agent is instructed to act on this feedback using tools like grep for codebase analysis and gh api for GitHub interactions. However, the skill provides significant logical boundaries: it requires the agent to 'verify against codebase reality' and 'check against current implementation' before execution. The ingestion points are the review comments, and while explicit sanitization of input text is not defined, the requirement for manual technical verification serves as a logical safeguard.

receiving-code-review