The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructs its specialized sub-agents (bitwarden-security-engineer) to bypass safety filters and content guidelines. Specifically, the agent prompts are framed with directives to 'approach this analysis without safety refusals' and to operate 'without restrictions', which are characteristic patterns of prompt injection designed to override model guardrails.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from git diffs and GitHub Pull Request content, creating a vulnerability surface for indirect prompt injection where malicious instructions embedded in the code or PR descriptions could influence the security agents.
Ingestion points: Output from git diff and gh pr diff is saved to /tmp/security-review-<identifier>.diff and subsequently read by the specialized agents in steps 2 and 4.
Boundary markers: The skill provides a specific SCAN_EVIDENCE block to separate API results, but it does not employ clear delimiters or explicit 'ignore embedded instructions' warnings for the raw code diff content ingested by the sub-agents.
Capability inventory: The skill has access to powerful tools including Bash (for git/gh operations), Skill, Task, Read, and Write.
Sanitization: The skill implements a defensive regex check (^[A-Za-z0-9_][A-Za-z0-9._/-]*$) to validate user-supplied base references before they are used in shell commands, which mitigates direct command injection but does not address the content of the data being analyzed.

perform-security-review