The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context syntax !plannotator review $ARGUMENTS in SKILL.md. This executes a shell command at the moment the skill is loaded by the agent. Because user-supplied arguments are interpolated directly into the shell command string, it creates a potential command injection vector if the host platform does not strictly sanitize the $ARGUMENTS variable.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon feedback provided through an external browser-based UI. This creates an attack surface where a malicious actor (or a malicious PR URL) could provide feedback containing instructions meant to hijack the agent's behavior.
Ingestion points: Output from the plannotator review command in SKILL.md.
Boundary markers: None. The skill instructs the agent to "address them in the same conversation" without providing delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has access to the Bash tool, specifically scoped to plannotator:* commands.
Sanitization: None observed in the instructions.
[COMMAND_EXECUTION]: The skill relies on executing the plannotator CLI tool to perform its primary function, which involves shell execution and interaction with the local worktree.

plannotator-review