The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (code diffs and intent descriptions) as its primary input. This data is interpolated into subagent prompts without explicit boundary markers or sanitization, creating a surface where malicious instructions embedded in a code comment could attempt to influence the agent's review logic.
Ingestion points: reviewer-prompt.md interpolates {DIFF_OR_FILES} and {INTENT} into the subagent's execution context.
Boundary markers: The prompt template lacks explicit delimiters (e.g., XML tags or unique markers) or specific instructions to the agent to ignore any embedded commands within the diff content.
Capability inventory: The skill is configured to read project artifacts via /domain-modeling and orchestrate reviewer agents via /pstack-swarm.
Sanitization: There is no evidence of filtering or sanitizing the content of the diffs before they are processed by the LLM subagents.

pstack-interrogate