The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection vulnerability. The skill processes untrusted input from git diffs and new files, then incorporates this data into a prompt for the agy agent.
Ingestion points: scripts/review.sh reads uncommitted changes via git diff and reads untracked file contents using cat.
Boundary markers: The script wraps untrusted content in unique fences (six backticks) and includes an explicit 'SECURITY' warning in the prompt instructing the agent to treat the content as data and ignore embedded instructions.
Capability inventory: The agy agent is granted read access to the full repository root (--add-dir "$GIT_ROOT"). Since the tool auto-runs calls in its print mode, an injected agent could be tricked into reading sensitive files (e.g., .env, SSH keys, or AWS credentials) stored within the repository and outputting them.
Sanitization: No validation or sanitization is performed on the diff or file contents beyond truncation for length.
[COMMAND_EXECUTION]: Local execution of CLI tools. The script executes git and agy (Antigravity CLI) to perform its core functions. These are standard operations for a development-focused skill.

gemini-review-code