The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted external data (git diffs and source code) and has the capability to modify the filesystem and execute shell commands, creating a vulnerability surface where malicious code could influence the agent's behavior.
Ingestion points: The skill reads git diffs in Step 1, source files in Step 3, and pinned head/base snapshots in Step 4 of SKILL.md.
Boundary markers: The instructions lack explicit boundary markers or system instructions to the agent to ignore natural language instructions embedded within the data being audited.
Capability inventory: The skill is granted Bash, Write, Edit, and Agent tools, allowing it to execute arbitrary commands and modify files during the 'AUTO-FIX' phase.
Sanitization: There is no evidence of sanitization or filtering of the ingested code to prevent embedded instructions from being interpreted by the LLM.
[EXTERNAL_DOWNLOADS]: The skill relies on an external script located at a relative path outside its own directory structure.
Evidence: SKILL.md Step 1 references ../../../scripts/review-scope.py. While likely a workspace utility, this is an external dependency for the skill's execution.
[COMMAND_EXECUTION]: The skill is configured with shell access and instructions to execute local scripts.
Evidence: allowed-tools includes Bash and the workflow in SKILL.md involves running the review-scope.py script and potentially other tools via the subagent delegation in Step 4.

review-security