The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources and interpolates it into sub-agent instructions.
Ingestion points: Content is ingested from git diff output, git log commit messages, issue descriptions retrieved via gh issue view or glab, and specification files (docs/, specs/).
Boundary markers: The prompt construction for the sub-agents does not utilize explicit delimiters or "ignore instructions" wrappers for the untrusted data, which could allow malicious instructions in a diff or issue to be interpreted as agent commands.
Capability inventory: The skill can read project files and spawn sub-agents to perform further analysis.
Sanitization: The skill does not perform sanitization, filtering, or escaping on the content of the diffs or specs before passing them to the sub-agents.

two-axis-review