The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git diff to analyze code changes and executes build or test commands to verify auto-applied fixes. This is standard behavior for a review tool and is consistent with its stated purpose.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from user-provided deliverables (files or code diffs) and interpolates this content directly into prompts for sub-agents. These sub-agents then provide feedback that can trigger automatic file writes and command execution by the coordinator agent. The lack of explicit boundary markers or instructions to ignore embedded commands in the reviewed content increases the risk that malicious instructions within a document could influence the agent's actions.
Ingestion points: The coordinator reads the full content of deliverables or code diffs in SKILL.md (Phase 1 and Phase 3).
Boundary markers: The prompt template uses headers like '## Deliverable Under Review' but lacks explicit 'ignore embedded instructions' warnings for the sub-agents.
Capability inventory: The skill possesses file-write capabilities (auto-fixing code and documents) and subprocess execution capabilities (running build and test commands) as defined in SKILL.md (Phase 4).
Sanitization: There is no evidence of sanitization, escaping, or validation of the deliverable content before it is interpolated into the prompts for the expert agents.

moe-review