The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/peer-invoke.sh invokes peer LLMs with flags that explicitly bypass security measures. It uses --dangerously-bypass-approvals-and-sandbox for the Codex CLI and --dangerously-skip-permissions for the Claude CLI. These settings disable human-in-the-loop approvals and sandboxing, granting the peer LLMs autonomous capability to perform actions or access resources.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted repository data and including it in instructions to the peer reviewer.
Ingestion points: In scripts/preflight.sh, the skill reads project context from CLAUDE.md, package.json, and README.md to build the initial review prompt.
Boundary markers: The prompt templates in references/prompt-templates.md lack delimiters or instructions to ignore potentially malicious embedded commands in the project context variables.
Capability inventory: The peer agents possess local repository access and the host agent automatically implements and commits code changes suggested by the peer, creating a loop where injected instructions could lead to persistent code changes.
Sanitization: No sanitization or validation of the text extracted from the repository metadata files is performed before it is interpolated into the prompts.

review-loop