The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes system commands using subprocess.run to interact with git (in scripts/project-scanner.py) and the GitHub CLI (in scripts/sarif-uploader.py). These calls are executed using argument lists rather than shell strings, which is a standard security practice to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user code, PR diffs, and repository metadata, creating a potential surface for indirect injection. The risk is mitigated through the following evidence chain:
Ingestion points: Files, diffs, and git ranges are read by scripts/project-scanner.py and referenced in SKILL.md.
Boundary markers: SKILL.md contains strict 'Critical Rules' (e.g., Rule 2: Never edit files during read-only review; Rule 9: Do not present as installable or invocable skills) that explicitly define the agent's behavioral limits.
Capability inventory: The skill has access to subprocess.run (git/gh) and file system writes for history and packaging, but these are gated by user approval logic.
Sanitization: scripts/source-audit.py includes logic to identify and redact sensitive credentials from scanned text before it is presented to the agent or user.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill includes a dedicated static analysis tool (scripts/source-audit.py) that uses regular expressions to detect and redact API keys, tokens, and other secrets from audited codebases. This prevents sensitive data from being leaked into logs or agent outputs.
[EXTERNAL_DOWNLOADS]: Interaction with external services is limited to the GitHub API via the gh CLI for uploading SARIF reports. This targets a well-known, trusted service and follows the intended purpose of the skill as a developer auditing tool.

review