The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the worktree and external files without sanitization.
Ingestion points: The skill reads the output of git diff and reads from a predictable local path: /tmp/$(basename "$PWD")/code-review.md (Step 2).
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the code or the review file.
Capability inventory: The skill utilizes several powerful capabilities including file modification via perl (Step 7), code linting with ruff and mypy, and test execution via pytest (Step 12).
Sanitization: The skill does not implement any validation or sanitization of the content fetched from the diffs or the temporary review file before processing it.
[COMMAND_EXECUTION]: The skill performs direct shell command execution to automate code cleanup and verification.
Evidence: It uses perl -CSD -0pi -e 's/\x{2014}/-/g' <files> to modify files in place (Step 7).
Evidence: It invokes ruff, mypy, and pytest on project files (Step 12).
Context: These commands are standard for a refactoring workflow and target files within the current repository or a specific /tmp directory.

python-refactor