The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data in the form of code changes via git diffs. An attacker could craft malicious code comments or data within a Pull Request designed to override the agent's instructions during the review process.
Ingestion points: git diff HEAD and git diff --cached (SKILL.md).
Boundary markers: None present; the agent is instructed to review the raw output of the diff commands without specific delimiters for the untrusted content.
Capability inventory: Shell command execution (git diff, mkdir) and file system write access for report generation.
Sanitization: None observed for the ingested diff data; however, the skill explicitly mandates a "read-only" workflow for source code, which serves as a significant structural control.
[COMMAND_EXECUTION]: The skill executes shell commands to retrieve code changes and organize report output.
Evidence: git diff HEAD, git diff --cached, and mkdir -p "/tmp/$(basename "$PWD")" (SKILL.md).
Context: While these commands are necessary for the skill's primary function, the use of command substitution $(basename "$PWD") within a shell command represents a potential command injection vector if the current working directory name contains shell metacharacters.

python-review