The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of code snippets, file contents, and git diffs provided by the user (as detailed in SKILL.md). This constitutes an indirect prompt injection surface where malicious instructions could be embedded in the code under review.
Ingestion points: Untrusted data enters the agent context through file reading commands or direct text input from the user describing their code.
Boundary markers: The skill implements a structured multi-model merger (documented in ref/multi-model.md) that acts as a boundary. It validates the output of subagents against a strict contract (ref/reviewer.md) and maps findings back to a predefined rules catalog (ref/catalog.md).
Capability inventory: The skill has the ability to read project files, write temporary file snapshots to the system's temporary directory for analysis, and spawn subagents.
Sanitization: The orchestration logic performs structural verification of responses and filters out findings that do not map to the authoritative catalog or that reference non-existent code lines.
[COMMAND_EXECUTION]: The script tests/smoke_test_dup_scan.py uses subprocess.run() to execute the skill's own local utility tools/dup_scan.py. This is a benign diagnostic pattern used to verify that the duplicate scanner is functioning correctly before use in a production environment.
[SAFE]: The skill uses vendor-specific model IDs (e.g., yzr-dashscope/qwen3.8-flash) which align with the author's namespace and indicate the use of official, platform-provided resources.

yzr-coding-review