The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code, creating a surface for indirect prompt injection attacks.
Ingestion points: The scripts scripts/pr_analyzer.py, scripts/code_quality_checker.py, and scripts/review_report_generator.py are designed to process external code files.
Boundary markers: The instructions do not specify any delimiters or warnings to the agent to disregard natural language instructions that might be embedded in the code being reviewed (e.g., within comments).
Capability inventory: The agent is tasked with evaluating code quality and security, meaning its output could influence deployment or merge decisions.
Sanitization: No sanitization or filtering logic is present to identify or neutralize instructions within the target code.
[COMMAND_EXECUTION]: The skill provides several Python scripts and references various CLI tools for code analysis.
Evidence: The scripts/ directory contains pr_analyzer.py, code_quality_checker.py, and review_report_generator.py which are intended for local execution. Documentation also references using ruff, mypy, radon, bandit, and detect-secrets via the shell.
[EXTERNAL_DOWNLOADS]: The setup instructions and guidelines reference the installation of various dependencies and tools from public registries.
Evidence: SKILL.md mentions npm install and pip install -r requirements.txt. Reference documents mention using well-known packages such as immer and various Python linting/security tools.

code-reviewer