The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code as its core function, creating an entry point for indirect prompt injection where instructions hidden in the reviewed files could attempt to override agent behavior.
Ingestion points: Files within the target repository are ingested via references/scope-discovery.md and references/orchestration.md.
Boundary markers: The references/subagent-template.md provides role definitions to sub-agents, but the skill does not wrap the untrusted code in specific delimiters to distinguish it from instructions.
Capability inventory: The skill can spawn multiple sub-agents and execute read-only git commands.
Sanitization: No explicit sanitization or instruction-filtering is performed on the code content before analysis.
[COMMAND_EXECUTION]: The workflow utilizes standard shell commands to determine the context and scope of the review.
Evidence: references/scope-discovery.md and references/intent-discovery.md utilize git status, git diff, git log, and git show to inspect the local repository state. These commands are used solely for information gathering.

review-team