The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted input from GitHub Pull Requests (including descriptions, diffs, and comments) in scripts/collect-pr-context.py. This content is provided to a nested reviewer agent as instructions and context via scripts/get-review-material.py. Maliciously crafted pull request data could attempt to execute indirect prompt injection attacks to influence the reviewer agent's judgment or behavior.
[COMMAND_EXECUTION]: In scripts/run-review.py, the skill invokes the nested Claude reviewer using the --permission-mode bypassPermissions flag. Additionally, SKILL.md and references/codex.md contain instructions to run nested Codex reviewers with 'escalated sandbox permissions'. These practices intentionally bypass the platform's standard security confirmation prompts, significantly reducing user oversight when processing external, untrusted data.
[COMMAND_EXECUTION]: The skill relies on multiple Python scripts that execute shell commands and external CLI tools (git, gh, claude, codex) via subprocess.run to collect context, run reviews, and post comments. This creates a large execution surface dependent on the security of the host environment's CLI tool configuration.
[COMMAND_EXECUTION]: The script scripts/run-review.py dynamically creates a configuration file (settings.json) that points to a Python hook script (guard-plugin/scripts/require-final-json.py) to be executed by the nested AI agent during its operation, representing a dynamic tool configuration pattern.

recipe-pr-review