The Agent Skills Directory

[COMMAND_EXECUTION]: The subagent template in code-reviewer.md dynamically constructs shell commands using the {BASE_SHA} and {HEAD_SHA} placeholders (e.g., git diff {BASE_SHA}..{HEAD_SHA}). Because these variables are interpolated directly into shell strings without strict validation, a malicious user or compromised agent could provide strings that execute arbitrary shell commands. \n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content (code changes). An attacker could include instructions in the code diffs designed to subvert the agent's checklist or influence its verdict. \n
Ingestion points: The agent ingests external data from git diff command output in code-reviewer.md. \n
Boundary markers: The template does not use specific delimiters or instructions to treat the diff content as untrusted data or to ignore instructions contained within it. \n
Capability inventory: The skill can execute git commands and provides analysis that affects the user's development workflow. \n
Sanitization: There are no mechanisms identified to sanitize or filter potential natural language instructions from the ingested code.

requesting-code-review