The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically code diffs and specification files, which creates a potential surface for indirect prompt injection.
Ingestion points: The agent context receives untrusted data through commit diffs and specification documents located in the repository's docs/specs directory or as provided by the user (SKILL.md, Section 1).
Boundary markers: The skill employs a structural boundary by spawning parallel sub-agents to prevent context pollution between the Standards and Spec axes, though it lacks explicit prompt-level delimiters or instructions to ignore embedded commands within the diffs (SKILL.md, Section 3).
Capability inventory: The agent maintains standard capabilities for repository exploration and file reading.
Sanitization: The instructions do not specify any sanitization, escaping, or filtering of the external code or spec content before it is processed by the sub-agents.

code-review