The Agent Skills Directory

[SAFE]: The skill consists entirely of instructional markdown files providing guidelines for code reviews. It does not contain executable code, script execution, or network operations.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes defensive instructions to verify that 'secrets, signing values, and environment policy' are kept out of build logic and that 'auth/network code' properly clears cached tokens and redacts debug output. These are positive security guidelines.
[INDIRECT_PROMPT_INJECTION]: While the skill's purpose is to analyze untrusted external data (code submitted for review), it provides a static checklist for analysis rather than a mechanism that could be subverted by instructions within that code. The focus is on identifying risks such as behavior mismatches and security vulnerabilities in the target repository.

kmp-review