The Agent Skills Directory

[COMMAND_EXECUTION]: The test harness (scripts/test-review-harness.py) and unit tests (scripts/autoreview_test.py) utilize subprocess.run to execute Git commands for repository setup, commit simulation, and to invoke the autoreview script for verification. This behavior is restricted to the development and testing environment.
[DYNAMIC_EXECUTION]: The test suite (scripts/autoreview_test.py) employs importlib and SourceFileLoader to dynamically load the autoreview script for testing purposes, as the script is distributed without a .py extension.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted source code from local branches, commits, or pull requests. While the instructions specify robust isolation (e.g., empty workspaces, safe-mode flags) and pre-processing steps, the processing of external content creates an inherent attack surface for indirect prompt injection.
Ingestion points: Code diffs and repository content from branches, commits, or PRs (e.g., via --mode branch or --mode commit).
Boundary markers: The tool partitions large bundles into bounded passes and performs validation on the structured JSON output returned by the engines.
Capability inventory: The skill invokes external review engines (Codex, Claude, Pi, Kimi) in isolated environments with tools, filesystem access, and subagents disabled.
Sanitization: Employs TruffleHog to scan for and redact secrets in the code bundle before it is transmitted to the review engine.
[CREDENTIALS_UNSAFE]: The directory tests/fixtures/ contains a file (typescript-sensitive-literals.ts) with hardcoded strings that match patterns for sensitive credentials, such as API keys and Slack tokens (e.g., sk-proj-FAKE..., xoxb-FAKE...). These are explicitly labeled as "FAKE" and are intended for testing the tool's ability to detect actual secrets in production code.

autoreview