The Agent Skills Directory

[SAFE]: The skill is designed with an 'assume-malicious' posture toward pull request data.
The SKILL.md explicitly instructs agents to treat PR titles, bodies, and comments as untrusted input and to never obey instructions found within them.
[SAFE]: Path Confinement.
The collect-rules.mjs script implements strict path validation and 'confinement' logic to prevent malicious PRs from using symlinks or @import directives to access sensitive files on the host machine or within the agent's memory storage.
[SAFE]: Output Sanitization.
post-review.mjs scans all content for secret patterns (tokens, private keys) and uses homoglyph folding (Cyrillic/Greek to Latin) to prevent attackers from bypassing verdict logic using look-alike characters.
It uses secure file descriptor operations (O_NOFOLLOW, fstatSync) to prevent TOCTOU (Time-of-Check to Time-of-Use) and symbolic link attacks when reading review bodies.
[SAFE]: Command Execution Restrictions.
Operations are mediated by a hook-based 'post gate' that limits Bash commands to a strict allowlist of read-only and validated operations, preventing arbitrary code or test execution during the review process.

review-pr