The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted source code diffs from local files or GitHub pull requests and provides them to a subagent for analysis without strict boundary markers.
Ingestion points: Untrusted data is retrieved using git diff and gh pr diff in the architecture's Step 1 and Step 2.
Boundary markers: The subagent prompt described in Step 4 does not specify the use of robust delimiters (such as XML tags or unique markers) to isolate the diff content from the agent's instructions, nor does it explicitly instruct the agent to ignore commands embedded in the code being reviewed.
Capability inventory: The skill has access to the Bash tool for shell execution, the Edit tool for modifying project files, and the TaskCreate tool for generating system tasks.
Sanitization: No evidence of sanitization or filtering of the diff content is present before it is passed to the LLM.
[DYNAMIC_EXECUTION]: The skill uses a dynamic routing mechanism that preloads domain-specific skill files based on file extensions. It constructs file paths at runtime (e.g., skills/{domain}-ops/SKILL.md) to provide specialized context to the subagent, which constitutes dynamic loading from computed paths.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute various external CLI utilities for its core logic, including git, gh (GitHub CLI), delta, difft, jq, and rg.
[CREDENTIALS_UNSAFE]: The framework-checks.md reference file contains several examples of hardcoded secrets, such as sk-1234567890abcdef and hunter2, in its security best practices section. While these are intended as educational examples of 'BAD' patterns to avoid, they trigger credential detection signatures.

review