The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and configuration files from the user's project (e.g., Swift files, Info.plist) to perform a release review. This ingestion of external data constitutes an indirect prompt injection surface where instructions hidden within the project files could potentially influence the agent's audit findings.
Ingestion points: The skill uses Read, Glob, and Grep tools to analyze project contents across six review phases as defined in SKILL.md and the associated checklist files.
Boundary markers: The instructions do not define explicit delimiters or 'ignore instructions' warnings to the agent to distinguish project data from its own instructional context.
Capability inventory: The skill's capabilities are restricted to read-only filesystem access via allowed-tools (Read, Glob, Grep); it cannot perform network requests, execute shell commands, or write to the filesystem, which significantly mitigates the impact of potential injections.
Sanitization: Content read from external files is not sanitized or filtered before being processed by the agent.

release-review