The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the review-to-rule CLI tool with arguments derived from user-provided URLs and repository paths. While the instructions use single-quote wrapping for arguments, this pattern requires the underlying execution environment and the CLI tool itself to handle input sanitization correctly to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub review comments to generate Semgrep rules and repository policies. This creates an attack surface where a malicious review comment could contain instructions intended to influence the agent's behavior or generate insecure rules. The skill follows security best practices by requiring the user to explicitly approve all generated artifacts and the final write command before execution.
Ingestion points: The review-comment-url parameter in SKILL.md is the primary entry point for external data.
Boundary markers: The skill instructions do not explicitly define delimiters for the ingested content, relying instead on the CLI tool for isolation and validation.
Capability inventory: The agent has the capability to write files (--write) and perform Git operations (--open-pr) via the review-to-rule CLI tool, as described in SKILL.md steps 3 and 4.
Sanitization: Explicit sanitization is not handled within the skill instructions; it is delegated to the internal logic of the review-to-rule CLI.
[EXTERNAL_DOWNLOADS]: The skill depends on a pre-installed CLI utility named review-to-rule. The source, integrity, and installation process for this dependency are not defined within the skill file, making it an external dependency that must be managed by the host environment.

review-to-rule-write