The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of git diffs and file contents, which could contain malicious instructions designed to subvert the agent's logic.
Ingestion points: Untrusted content is ingested from git diff and git ls-files outputs in scripts/review.sh (lines 135-155).
Boundary markers: The skill uses six-backtick fences (``````) and an explicit 'SECURITY' warning block in the prompt (SKILL.md, Security section) to instruct the model to treat the content as data only.
Capability inventory: The skill invokes the claude CLI with restricted tools (Read, Grep, Glob) and no network access. The wrapper script uses git, cat, wc, head, and sed to process the repository state.
Sanitization: The script truncates inputs exceeding 1MB to mitigate potential resource exhaustion and maintains strict tool-level permissions through the claude CLI flags.

claude-review-code