The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands and Python scripts to manage the auditing workflow, including environment probing, plan generation, and report synthesis.
Evidence: Phase 1 and Phase 3 use find, grep, and awk via Bash to identify project features and codebase context.
Evidence: Phase 4 executes a local vendor script python3 "${C_REVIEW_PLUGIN_ROOT}/scripts/build_run_plan.py" to generate the analysis plan.
Evidence: Phase 8b executes a local vendor script python3 "${C_REVIEW_PLUGIN_ROOT}/scripts/generate_sarif.py" to produce standardized vulnerability reports.
[PROMPT_INJECTION]: The skill processes untrusted source code from the target repository, creating an attack surface for indirect prompt injection where malicious code comments could influence sub-agent behavior.
Ingestion points: Local source files in the finding_scope_root and context_roots directories (SKILL.md).
Boundary markers: Absent in the orchestrator instructions.
Capability inventory: Bash, Write, Edit, Grep, Glob are available to the c-review-worker and c-review-fp-judge sub-agents (SKILL.md).
Sanitization: No sanitization or filtering of analyzed file content is specified in the orchestrator logic.

c-review