The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and the review template utilize shell commands such as git rev-parse, git log, and git diff to identify changes within a repository.
[DYNAMIC_EXECUTION]: In code-reviewer.md, shell commands are constructed by interpolating variables like {BASE_SHA} and {HEAD_SHA} into a git diff command. This creates a surface for command injection if the variables, derived from branch names or user input, contain shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The subagent is tasked with reviewing code and requirements, which are external data sources that could contain adversarial content designed to mislead the reviewer or override its instructions.
Ingestion points: Untrusted data enters the agent context through the {WHAT_WAS_IMPLEMENTED} and {PLAN_OR_REQUIREMENTS} placeholders, as well as the output of the git diff command in code-reviewer.md.
Boundary markers: The template lacks explicit delimiters or instructions to treat the interpolated content as potentially untrusted data.
Capability inventory: The subagent has access to the local filesystem and the ability to execute git commands via the shell.
Sanitization: No mechanisms for validation, filtering, or escaping are present to process the inputs before they are included in the prompt or executed.

requesting-code-review