The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/autoreview script contains a start_parallel_tests function that uses subprocess.Popen(command, shell=True) to execute arbitrary strings provided via the --parallel-tests command-line argument. This allows the agent to execute any shell command on the host system during the review process.
[DATA_EXFILTRATION]: The skill collects git status, staged/unstaged diffs, and the full content of untracked files (up to 40,000 characters per file) and includes them in prompts sent to external AI engines such as Codex, Claude, and Copilot. This constitutes exfiltration of local source code to external service providers.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection where malicious instructions embedded in the code being reviewed could influence the AI reviewer's output. For example, an attacker could craft a patch containing comments that instruct the reviewer to ignore defects or mark the patch as safe.
Ingestion points: Local git diffs and untracked file contents are read in the local_bundle, branch_bundle, and commit_bundle functions in scripts/autoreview.
Boundary markers: The build_prompt function uses basic Markdown headers (e.g., '# Change Bundle') to separate instructions from the data, which is insufficient to prevent an engine from following instructions within the bundle.
Capability inventory: The script can execute shell commands (git, gh, and user-supplied tests), read and write local files, and communicate with external AI service binaries.
Sanitization: The reviewed code content is interpolated directly into the prompt string without any escaping or sanitization of prompt-like patterns. Output from the AI engine is validated against a JSON schema, but this does not prevent the engine's reasoning from being compromised by the input.

autoreview