The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python scripts in the "scripts/" directory use "subprocess.run" to execute shell commands. Specifically, "project-scanner.py", "check.py", and "sarif-uploader.py" interact with "git" and the GitHub CLI ("gh") to perform project analysis and report uploading. These operations are scoped to the skill's primary purpose of reviewing code and managing project metadata.
[EXTERNAL_DOWNLOADS]: The "scripts/sarif-uploader.py" script interacts with GitHub's API to upload security findings in SARIF format. This is a legitimate feature for CI/CD integration and targets a well-known technology provider.
[DATA_EXFILTRATION]: The skill implements persistent state management for review history and 'learnings' (dismissed false positives). Scripts like "review-store.py" and "learnings-store.py" read and write JSON files in the user's home directory (e.g., "~/.claude/reviews/"). While this involves accessing files outside the immediate project directory, it is a documented mechanism for cross-session continuity.
[SAFE]: The skill includes extensive documentation and protocols designed to ensure that the AI agent operates under a model of least privilege and requires human-in-the-loop confirmation before applying any changes to the codebase. It also provides a specific lens for auditing the security and provenance of other external skills before they are installed.

review