The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run across multiple scripts (collect-pr-context.py, run-review.py, post-comments.py) to execute system tools such as git, gh (GitHub CLI), claude, and codex. This is fundamental to the skill's ability to fetch PR data, run reviewer engines, and post comments.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from GitHub PRs, including diffs, file contents, and comments, which could contain adversarial prompts. 1. Ingestion points: PR diffs and comments are collected in scripts/collect-pr-context.py and provided to models via scripts/get-review-material.py. 2. Boundary markers: The references/reviewer-system-prompt.md defines a strict role for the model, and the skill uses a separate orchestrator/reviewer architecture. 3. Capability inventory: The orchestrator executes git and gh via subprocess. Nested reviewer models are restricted to read-only environments or have write-capable tools disabled. 4. Sanitization: All reviewer output is validated against a formal JSON schema (schemas/review-result.schema.json) using a dedicated validation hook (scripts/guard-plugin/scripts/require-final-json.py) before being processed by the orchestrator.- [PRIVILEGE_ESCALATION]: The scripts/run-review.py script executes nested Claude reviewer instances using the --permission-mode bypassPermissions flag. This flag allows tools to execute without manual user confirmation, facilitating non-interactive automation. The risk is mitigated by explicitly disabling all write-capable tools (Write, Edit, MultiEdit, NotebookEdit) for the nested instances.

recipe-pr-review