The Agent Skills Directory

[SAFE]: The skill follows security best practices by explicitly instructing the agent to redact secrets before forwarding or reporting any data. It also warns against silently installing dependencies or substituting missing tools with similarly named ones, reducing supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including commit text, pull request descriptions, and issue comments across SKILL.md and references/merged-history.md. The skill includes a mandatory evidence chain and strong mitigation instructions: it explicitly commands the agent to treat this data as untrusted evidence and to never execute instructions embedded within that data.
[COMMAND_EXECUTION]: The skill is designed to perform code repairs and verification when the --fix flag is explicitly provided. These operations are scoped to identified defects and are verified using local test-runner tools, with instructions to preserve existing technical language and product intent.

weekly-review