The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from multiple sources without using boundary markers or sanitization.
Ingestion points: git diff output (committed, staged, unstaged, and untracked files), docs/agents/issue-tracker.md, and external spec files.
Boundary markers: Absent. There are no instructions to wrap or delimit these inputs.
Capability inventory: Shell execution (git), arbitrary command execution in Step 5, and file system writes (scratch directory).
Sanitization: Absent. The skill instructions tell the agent to process these files directly and execute derived commands verbatim.
[DYNAMIC_EXECUTION]: The skill implements a high-risk pattern where the Defects sub-agent generates checks (commands, tests, or lookups) that the main agent is then instructed to execute in Step 5 ('Run every check it listed yourself'). Because these checks are derived from analyzing untrusted code changes, this creates a vector for executing code or commands controlled by an external attacker.
[COMMAND_EXECUTION]: The agent uses shell commands to gather context via git. More critically, Step 5 allows for the execution of arbitrary commands suggested by the LLM sub-agent, which lacks oversight and can be manipulated via the content of the files being reviewed.
[DATA_EXFILTRATION]: Since the agent has read access to the repository and the ability to execute network-capable commands (such as curl or wget) if suggested by the sub-agent, it is vulnerable to data exfiltration attacks triggered by malicious comments in a code diff or spec file.

code-review