The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from git diffs and user-provided intent strings and interpolates them directly into subagent prompts without adequate sanitization or boundary markers.
Ingestion points: The skill gathers content from git diff and file contents in Step 1, and user messages in Step 2 of SKILL.md.
Boundary markers: The template in references/reviewer-prompt.md uses simple blockquotes for the intent and no delimiters for code diffs, which are insufficient to prevent a malicious payload in the code from hijacking the subagent's instructions.
Capability inventory: The agent has the ability to read the entire workspace via git and file access tools, and it spawns four subagents to process this data.
Sanitization: The skill does not perform any escaping, validation, or filtering of the external content before passing it to the subagents.
[COMMAND_EXECUTION]: The skill uses shell commands to gather context for the review process.
Evidence: SKILL.md instructs the agent to run git diff main...HEAD to collect the changeset. While this is the intended functionality, it acts as the primary ingestion vector for untrusted data that the agent then processes.

interrogate