The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the repository being reviewed, including code diffs, pull request metadata, and project-level instruction files. This creates a surface for indirect prompt injection if an attacker embeds malicious instructions in the codebase or documentation to bias the review outcome.
Ingestion points: The skill reads git diffs, pull request titles/bodies (via gh pr view), and project-specific instructions (CLAUDE.md, AGENTS.md) across references/code-review.md and references/team-review.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agents to ignore instructions embedded within the analyzed content.
Capability inventory: The skill has read access to the project filesystem, uses the GitHub CLI (gh) for network operations, and orchestrates several high-capability agents (e.g., security-auditor, code-auditor).
Sanitization: No sanitization or structured validation is applied to excerpts from the codebase before they are interpolated into the prompts for downstream reviewers.
[COMMAND_EXECUTION]: The skill extensively uses shell-based tools (git, gh) to analyze the repository state and PR information.
Evidence: Multiple markdown files in the references/ directory contain complex bash scripts that fetch metadata from GitHub and perform multi-step git operations using variables like $ARGUMENTS, $BASE_ARG, and $CHANGED_FILES.

review-preparation