The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell command execution via the subprocess.run module to perform its auditing tasks. This includes executing git commands for status and log analysis, running the ruff linter for code quality checks, and using the coverage tool to assess test suite completeness. These operations are core to the skill's functionality as a codebase reviewer.
[DATA_EXFILTRATION]: The skill is configured to access and inventory sensitive local file paths. This includes the skill's own configuration file (~/.ac-reviewing-codebase) and platform-specific agent memory directories (e.g., ~/.claude/projects/*/memory/, ~/.codex/, ~/.cursor/). The stated purpose is to promote operational knowledge from these files into skills and playbooks, which represents a potential exposure of personal or project-specific data if the resulting skills are shared.
[INDIRECT_PROMPT_INJECTION]: As a codebase reviewer, the skill processes untrusted content from repositories (code, markdown, and skill files). This creates a surface for indirect prompt injection, where maliciously crafted content in a repo could attempt to influence the agent's behavior during the review or delivery phases. The skill includes a mandatory completion checklist that requires evidence for each step, which provides some structural mitigation against accidental or forced abandonment of safety checks.
[EXTERNAL_DOWNLOADS]: The skill utilizes uv tool run for running linting tools and references external pre-commit hooks from the vendor's repository (https://github.com/souliane/skill-repo-boilerplate). These dependencies are associated with the standard toolset for this environment and the skill's primary purpose.

ac-reviewing-codebase