The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes git diffs and repository files, which represent untrusted data that could contain malicious instructions aimed at influencing the reviewer models.
Ingestion points: The scripts/run-review.sh script extracts git diffs and passes them to the fact-check model. The SWE and Architect models are given tools to read repository files.
Boundary markers: Persona files (e.g., prompts/swe.md, prompts/architect.md) include explicit warnings to the models that the input diff is untrusted and that no code should be executed.
Capability inventory: The opencode execution environment is strictly limited using the OPENCODE_PERMISSION environment variable, which denies tool access for editing, network operations, and execution of arbitrary shell commands (using a read-only allow-list for bash).
Sanitization: The raw diff and file content are provided to the models without specific sanitization or filtering of potential injection payloads.
[COMMAND_EXECUTION]: The skill relies on executing local git and opencode commands to collect data and perform the review.
The scripts/run-review.sh script invokes various git subcommands (diff, show, log, status, etc.) and the opencode CLI to drive the LLM-based review process.
These commands are essential for the skill's operation and are called with appropriate arguments to prevent simple command injection (e.g., using -- separators in git commands).

opencode-review