The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/review-scope.sh uses the eval command to re-split the SKILL_ARGS string into separate arguments. Although a character whitelist is applied to the input string before execution, the use of eval on user-supplied or harness-supplied data is a risky pattern that could lead to command injection if the whitelist is bypassed.
[DYNAMIC_EXECUTION]: The skill uses dynamic execution by invoking the eval shell command in scripts/review-scope.sh and by dynamically constructing git diff commands in SKILL.md based on parameters determined at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository being reviewed, creating a surface for indirect prompt injection where malicious instructions in the code or metadata could manipulate the agent's behavior.
Ingestion points: SKILL.md (Step 2 and 3) and references/lenses.md (Lenses 1, 3, 4, and 5) describe reading git diff output, git log commit messages, pull request comments via gh api, and guideline files (CLAUDE.md, AGENTS.md).
Boundary markers: Absent. The agent is instructed to read and process these contents directly without explicit delimiters or instructions to ignore embedded commands within the reviewed data.
Capability inventory: The agent has access to Bash, Read, Grep, and Glob tools, and its output (a PASS/FAIL verdict) is recorded into the validation pipeline.
Sanitization: The review-scope.sh script employs a character whitelist for initial arguments, but there is no evidence of sanitization or filtering for the instructions or content found within the code, commits, or comments during the lens-based review process.

review-code