The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from code diffs, pull requests, and commit ranges, which constitutes an indirect prompt injection attack surface.
Ingestion points: The diff target ($ARGUMENTS) and the diff text are ingested into the subagent's context in SKILL.md.
Boundary markers: The instructions lack specific structural delimiters or markers to isolate the untrusted diff content from the agent's instructions.
Capability inventory: The subagent has capabilities to execute shell commands for testing and read-only git operations as defined in SKILL.md and references/code-reviewer.md.
Sanitization: There is no mention of sanitizing or filtering the diff content before it is passed to the subagent.
[COMMAND_EXECUTION]: The skill explicitly allows the execution of shell commands, specifically the "project's test command."
Evidence: Both SKILL.md and references/code-reviewer.md include instructions for the subagent to run the test suite if a shell is available.
Context: This command execution is a core part of the code review functionality but involves running potentially untrusted scripts from the project being reviewed. The risk is mitigated by the instruction to use a "fresh-context read-only subagent" with restricted tool access and an environment allowlist as specified in shared/independent-review.md.
[DYNAMIC_EXECUTION]: The requirement to run the project's test suite involves the dynamic execution of scripts defined in the target codebase.
Evidence: references/code-reviewer.md instructs the subagent to report the results of the test-suite command. This represents the execution of logic that is not part of the skill itself but provided by the external project under review.

reviewing-code