The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from code diffs and specification files which could contain malicious instructions designed to influence the behavior of the review sub-agents. * Ingestion points: Git diff output (including staged and untrusted files), project documentation in docs/ or specs/, and issue tracker content fetched based on commit messages. * Boundary markers: The instructions for spawning sub-agents do not include explicit delimiters or warnings to ignore embedded instructions within the code or spec content. * Capability inventory: The skill orchestrates sub-agents via /pstack-swarm and executes local git commands. It does not possess direct high-privilege write capabilities, but the sub-agents' analysis could be manipulated. * Sanitization: There is no evidence of filtering or escaping logic applied to the external content before it is passed into the sub-agent prompts.
[COMMAND_EXECUTION]: The skill uses shell-level commands to perform repository operations. * Evidence: Uses git rev-parse and git diff to identify and capture changes. These are standard operations for a code analysis tool but represent a direct interaction with the host system's shell environment.
[EXTERNAL_DOWNLOADS]: The skill includes references to external repositories for maintenance and provenance. * Evidence: Links to the canonical source at github.com/mattpocock/skills are included in the documentation. These are treated as safe references to a well-known developer's repository for version tracking and do not involve the execution of untrusted remote payloads at runtime.

code-review