The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to utilize standard shell commands such as git diff, git log, and grep to inspect code changes and identify potential security risks like hardcoded credentials.
[EXTERNAL_DOWNLOADS]: The skill uses well-known developer tools to perform audits and fetch vulnerability data from trusted package registries, including npm audit, pip-audit, and cargo audit. It also installs the radon package from PyPI for maintainability analysis.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code as its primary data source, creating a vulnerability surface where instructions embedded in code comments or string literals could influence the agent's behavior.
Ingestion points: The skill reads all source code files provided for review.
Boundary markers: No specific delimiters or boundary markers are defined to isolate untrusted code from instructions.
Capability inventory: Access to shell execution through standard auditing and linting tools.
Sanitization: The skill processes source code files without explicit sanitization or filtering logic.

code-review