The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core function is to ingest and analyze untrusted data in the form of code diffs provided by the user. It lacks specific boundary markers or instructions to prevent the agent from following commands embedded in the code being reviewed. A malicious actor could use code comments or documentation within a pull request to influence the agent's grading logic or to suppress security warnings.
Ingestion points: The skill uses git diff main...HEAD as its primary input, which contains untrusted content from the repository being reviewed.
Boundary markers: There are no defined delimiters or explicit "ignore embedded instructions" warnings provided to the agent when it processes the diff content.
Capability inventory: The agent can read local check files, execute git commands, and generate a structured review with a grade, which could be influenced by the injected content.
Sanitization: No sanitization or filtering is applied to the diff output before it is processed by the agent.
[COMMAND_EXECUTION]: The checks/dependencies.md file includes a "Commands to Run" section listing shell commands such as npm audit, pnpm audit, and npx depcheck. An autonomous agent performing a "Deep" review might attempt to execute these commands automatically to gather data. Running package manager commands like npx on an untrusted project carries a risk of local code execution through malicious packages or script hooks.
[DYNAMIC_EXECUTION]: For deeper review levels (3 and 4), the skill architecture relies on dynamically reading and applying rules from a large set of external markdown files in the checks/ directory. This means the agent's behavior and the security logic it enforces are determined by files loaded at runtime, making the review process dependent on the local integrity of those files.

review