receive-review
处理 reviewer 反馈：Red→Green 修复 + 按 engagement mode 收口。Use when: 收到 review 结果或 P1/P2。Not for: 发 review 请求、自检。Output: 按 iterative / one-shot 契约闭环。
64
78%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Fix and improve this skill with Tessl
tessl review fix ./cat-cafe-skills/receive-review/SKILL.mdLow
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 skill 的运行入口是处理由 `github-review-feedback` connector/云端 Codex review 邮件/operator 告知触发的“review 反馈”并读取通知内容，但该文档未显示是否把来自外部（第三方）用户提交的自由文本直接注入到 LLM 可读输入，且其输入来源被描述为 GitHub 评审消息/packet，无法确认是否存在“先不选定 item 就摄取任意外部 free text”的队列/Feed 投递路径。
- Repository
- zts212653/clowder-ai
- Commit
090626a
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.