The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external code or diffs provided by the user, which establishes an attack surface where malicious instructions embedded in the reviewed data could attempt to influence the agent's behavior.
Ingestion points: The skill instructions specify reviewing "provided code or diff" and it has access to tools like read, grep, and glob to fetch this content from the filesystem (SKILL.md).
Boundary markers: There are no explicit instructions to the agent to treat the ingested code as data only or to ignore instructions embedded within the files being reviewed.
Capability inventory: The skill is configured with access to the bash tool in its frontmatter, which represents a potential target for exploitation if an injection were to successfully redirect the agent's execution flow.
Sanitization: The skill lacks any explicit sanitization or filtering logic to handle untrusted content before processing.

code-review