The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data from git diffs and external files directly into the instructions provided to the underlying LLM.
Ingestion points: The scripts/autoreview script reads content from git status, git diffs, and arbitrary files provided via the --dataset or --prompt-file arguments (see functions local_bundle, branch_bundle, and load_datasets).
Boundary markers: The script uses markdown headers (e.g., '# Change Bundle') and explicit 'Hard rules' within the prompt to separate instructions from data, but these markers can be bypassed by adversarial content within the reviewed code.
Capability inventory: The script has the ability to execute git commands and arbitrary shell commands through the parallel testing feature.
Sanitization: Content is truncated to length limits using the bounded() function, but no sanitization or escaping of prompt-sensitive characters is performed.
[COMMAND_EXECUTION]: The skill includes a feature to run concurrent tests which executes arbitrary shell commands.
Evidence: In scripts/autoreview, the start_parallel_tests function uses subprocess.Popen(command, cwd=repo, shell=True) to execute the string provided to the --parallel-tests argument. This allows for arbitrary command execution within the user's shell environment.

autoreview