The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md utilize authoritative language such as "Reflexive Trigger Rule (binding on every agent)," "reflex, not a request," and "STOP" to override the agent's default operational guidelines and enforce a mandatory governance workflow.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests git diff output and passes it to reviewer models (Strata A and B). Malicious content within the diff (e.g., code comments containing instructions) could manipulate the reviewer's scoring or approval verdict.
Ingestion points: scripts/cross-review.sh captures diff content via git diff and stores it in /tmp/cross-review-diff.patch for processing.
Boundary markers: The prompts defined in references/rubric.md do not utilize robust boundary markers or "ignore embedded instructions" warnings for the attached diff content.
Capability inventory: The skill dispatches other agents and skills, executes shell commands, and interacts with the filesystem.
Sanitization: No sanitization or escaping is performed on the diff data before it is presented to the reviewer models.
[COMMAND_EXECUTION]: The shell script scripts/cross-review.sh executes local system commands including git and a third-party CLI tool codex to perform analysis and cross-model evaluation.

cross-review