The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code changes from git and GitHub diffs, which creates a potential surface for indirect prompt injection. To mitigate this, the skill implements a mandatory 'Untrusted Input Boundary' instruction for all subagents. This instruction explicitly directs the subagents to treat any imperative or instruction-like language found within the code under review as a security finding (CWE-1427) rather than as commands to be followed.
Ingestion points: External code content is ingested via gh pr diff and git diff commands as defined in the review mode logic.
Boundary markers: The 'Untrusted Input Boundary' block is a required component of all subagent prompts, providing a clear structural delimiter for untrusted data.
Capability inventory: The skill uses Bash (for git/gh), Read, Write, Grep, Glob, and the Skill tool for subagent orchestration.
Sanitization: The instructions ensure that diff content is treated strictly as data for analysis, preventing the execution of embedded prompts.
[DATA_EXFILTRATION]: To prevent the leakage of sensitive source code, the skill's 'Tool Discipline' prompts explicitly forbid subagents from using network-enabled tools like WebFetch or WebSearch. This ensures that all analysis is performed using local tools and the authenticated GitHub CLI, maintaining a strict data boundary.
[COMMAND_EXECUTION]: The skill executes shell commands through the Bash tool to retrieve repository metadata and code diffs. These operations are limited to a set of pre-defined, non-destructive subcommands for git and gh (e.g., git log, gh pr view), which are properly scoped in the skill's allowed-tools configuration to prevent arbitrary command injection.
[REMOTE_CODE_EXECUTION]: The skill coordinates with sibling plugins such as bitwarden-security-engineer, claude-config-validator, and plugin-dev. These extensions are invoked using the platform's native Skill and subagent mechanisms rather than through unverified remote downloads, representing standard modular functionality from the vendor.

performing-multi-agent-code-review