The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted code diffs and PR descriptions as primary input for its sub-agents (SKILL.md Step 4 and Step 3.5b). This creates a surface for indirect prompt injection, where malicious instructions embedded in code comments or PR bodies could attempt to override the sub-agents' behavior or bias the review results.
Ingestion points: Git diff output and GitHub PR descriptions are ingested into the agent context in SKILL.md and SLICING.md.
Boundary markers: The skill does not use robust delimiters or specific 'ignore embedded instructions' warnings when interpolating untrusted data into sub-agent prompts.
Capability inventory: The orchestrator has access to shell commands (git, gh, awk), file writes to the docs/ directory, and the ability to launch multiple sub-agents.
Sanitization: No sanitization or filtering is performed on the diff content before it is passed to the sub-agents.
[COMMAND_EXECUTION]: The skill performs extensive shell operations to manage the review workflow, including the use of eval to construct git commands with varying pathspecs (SLICING.md). It also employs dynamic script generation by writing a custom awk script to /tmp/rr-prescan.awk at runtime to perform mechanical code linting (PRE-SCAN.md). While these operations are functional, they expand the skill's command execution surface.

rick-review