The Agent Skills Directory

[PROMPT_INJECTION]: The skill identifies and processes untrusted content from the repository (code changes and commit metadata) which is then used to construct prompts for AI review passes.
Ingestion points: ReviewContext in run.mts aggregates branch names, commit lists, and diff statistics for prompt interpolation.
Boundary markers: Prompts use structured headers but do not use unique delimiters to separate instructions from the analyzed code content.
Capability inventory: The skill utilizes git and file reading tools. The claude backend configuration in run.mts explicitly denies destructive capabilities such as Edit, Write, and file deletion tools (rm, mv).
Sanitization: There is no evidence of escaping or validation performed on branch names or code diffs before they are embedded in the prompt strings.
[COMMAND_EXECUTION]: The runner script executes git and various AI command-line interfaces on the local system.
Evidence: Commands are executed via @socketsecurity/lib/spawn using argument arrays, which prevents shell injection from metadata like branch names.
Scope: Execution is restricted to standard repository inspection commands and the configured AI backend binaries.

reviewing-code