The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/prepare_review_bundle.py uses the subprocess module to execute git commands (rev-parse, diff, status). It dynamically incorporates inputs from command-line arguments (such as --base, --head, and --repo) into the command list. While using a list-based API prevents shell injection, the absence of input validation allows for potential argument injection if the script is invoked with malicious parameters.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the reviewer agent is instructed to process data originating from potentially untrusted sources, such as repository diffs or user-provided summaries.
Ingestion points: The reviewer agent ingests content from files created in the .agent/code-reviews/ directory, including request.md, writer-summary.md, diff.patch, and test-output.md.
Boundary markers: The prompt templates provided in reviewer-prompt.md and references/isolation-protocol.md do not utilize distinct boundary markers or specific instructions to ignore embedded commands within the analyzed data.
Capability inventory: The reviewer agent has access to a broad set of tools, including Read, Write, Edit, Bash, and Glob, which could be exploited if the agent follows instructions hidden in the code artifacts.
Sanitization: The skill does not perform any sanitization or filtering of the content captured in the git diff or the summaries before they are presented to the reviewer agent.

code-reviewer