The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted pull request descriptions and source code files using the Read, Glob, and Grep tools. It lacks explicit boundary markers or instructions to disregard instructions embedded in the code being reviewed. The agent possesses the capability to read files and generate reports, but does not have execution or network privileges. No sanitization is performed on the code samples provided for review.
[EXTERNAL_DOWNLOADS]: The skill provides a link to documentation on jeffallan.github.io, a GitHub Pages site belonging to the author. This reference to a well-known service is a standard documentation practice and does not involve runtime code execution.
[SAFE]: The security alerts regarding malicious files and URLs appear to be false positives. The SKILL.md file contains text-based examples of common vulnerabilities (like SQL injection) for educational purposes, which likely triggered signature-based detection. The flagged URL is a legitimate documentation resource hosted on the author's infrastructure.

code-reviewer