The Agent Skills Directory

[COMMAND_EXECUTION]: The skill dynamically constructs shell commands using user-provided inputs like branch names and commit SHAs (e.g., git diff <branch>...HEAD and git diff <sha>~1..<sha>). If the agent interpolates these strings directly into the Bash tool without validation, it could lead to command injection. Additionally, it modifies the environment PATH at runtime to locate binaries.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local repository, specifically the output of git diff commands and project configuration files (CLAUDE.md, AGENTS.md). This content is included in prompts sent to external LLMs, exposing the review process to potential injection from the codebase.
Ingestion points: Git diff output and project files (CLAUDE.md, AGENTS.md).
Boundary markers: The prompt assembly uses --- delimiters to separate instructions from code.
Capability inventory: The skill utilizes the Bash tool to run git, codex, and agy commands.
Sanitization: The agy command uses the --disable-slash-commands flag to prevent interpretation of lines as CLI commands, but the diff content is not otherwise sanitized.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing external review tools from trusted organizations, such as OpenAI's @openai/codex via npm and Google's agy CLI from an official domain.
[DATA_EXFILTRATION]: To perform its primary function, the skill reads repository diffs and project documentation and transmits them to external LLM providers (OpenAI and Google). Users should be aware that their source code is being sent to these third-party APIs.

second-opinion