The Agent Skills Directory

[COMMAND_EXECUTION]: The prompt template in code-reviewer.md dynamically assembles shell commands using string interpolation. The variables {BASE_SHA} and {HEAD_SHA} are inserted directly into git diff and git diff --stat commands. If an attacker can influence the value of these variables (e.g., providing ; malicious_command as a SHA), it could lead to arbitrary command execution when the sub-agent runs the shell block.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). The placeholders {DESCRIPTION} and {PLAN_OR_REQUIREMENTS} in code-reviewer.md are interpolated directly into the instructions for the code reviewer sub-agent without sanitization or boundary markers.
Ingestion points: Data enters through the {DESCRIPTION} and {PLAN_OR_REQUIREMENTS} placeholders in code-reviewer.md.
Boundary markers: There are no delimiters (like XML tags or block quotes) or explicit warnings to the sub-agent to ignore instructions embedded within these variables.
Capability inventory: The sub-agent has the capability to execute git diff commands and provide a critical evaluation that influences the main agent's workflow (e.g., deciding whether to merge or proceed to the next task).
Sanitization: No escaping or validation is performed on the content of the description or requirements before interpolation into the prompt.
[COMMAND_EXECUTION]: In SKILL.md, the instructions for the main agent include executing shell commands to get Git SHAs (git rev-parse HEAD). While these specific examples are benign, the workflow encourages the agent to handle and pipe shell outputs which increases the attack surface if the environment contains untrusted file names or git history.

requesting-code-review