The Agent Skills Directory

[PROMPT_INJECTION]: The template in references/code-reviewer.md incorporates several placeholders like {WHAT_WAS_IMPLEMENTED} and {PLAN_OR_REQUIREMENTS} directly into the subagent's instructions. If these fields are populated with data from untrusted sources, such as a malicious pull request or external requirement document, they could be used to perform indirect prompt injection to steer the reviewer's assessment.
Ingestion points: SKILL.md and references/code-reviewer.md (placeholders {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, {BASE_SHA}, {HEAD_SHA}, {DESCRIPTION})
Boundary markers: None provided in the template to separate instructions from external data.
Capability inventory: Shell execution (git diff) and file reading across all files in the diff range.
Sanitization: No validation or escaping is applied to the interpolated content.
[COMMAND_EXECUTION]: The subagent is instructed to execute shell commands (git diff {BASE_SHA}..{HEAD_SHA}) where the arguments are provided via placeholders. Without proper sanitization or validation of the commit SHAs, there is a theoretical risk of command injection if an attacker can influence the values used for these variables (e.g., through maliciously named branches or tags containing shell metacharacters).

review-work