The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to identify and invoke other local AI agent CLI tools (e.g., GitHub Copilot, OpenCode, Codex, Amp) to perform reviews. It provides explicit instructions for the host agent to use temporary files and the cat command to securely pass large code diffs or prompts into these external tools, effectively preventing common shell quoting and injection vulnerabilities.
[DATA_EXFILTRATION]: The skill performs local environment discovery by scanning environment variables and filesystem paths (e.g., ~/.claude, ~/.config/copilot) to detect installed AI agents. This configuration and history are stored in a local agents.json file within the agent's own configuration directory. There is no evidence of this data being transmitted to external servers; the Python script uses only the standard library and performs no network operations.
[PROMPT_INJECTION]: The skill processes potentially untrusted code diffs and plans by interpolating them into a critique prompt for a separate AI model. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the code being reviewed. The skill mitigates this by providing a strict critique rubric, instructing the critic model to remain read-only, and requiring the host agent to summarize the critique rather than presenting it verbatim.
[SAFE]: The core logic is implemented in a Python script (rubber_duck.py) that handles deterministic tasks like host detection and model rotation. Analysis shows the script is inert; it does not execute subprocesses, open network sockets, or use dangerous functions like eval() or exec(). It functions purely as a state manager for the skill's workflow.

rubber-duck