The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python runner script (scripts/cross_review.py) which orchestrates the execution of external agent CLIs (Codex, Claude, and Antigravity). These commands are executed with shell=False and utilize restrictive environment allowlists to prevent sensitive data from reaching the reviewer processes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data, specifically repository files and git diffs, which could contain malicious instructions.
Ingestion points: Repository files, git diffs, and implementation plans are read by the reviewer CLIs through the generated brief.
Boundary markers: The skill uses comprehensive templates (references/implementation-brief.md, references/plan-brief.md) that explicitly define the reviewer's role as independent and read-only, serving as delimiters between instructions and data.
Capability inventory: The skill facilitates file reads and network communication via agent CLIs. The runner script enforces read-only sandboxes for Codex and Claude to prevent file modifications.
Sanitization: The skill applies secret hygiene to exclude credentials (.env, private keys) and filters environment variables to ensure only necessary authentication tokens reach the reviewer processes.

cross-review