The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted implementation code and git diffs, which creates a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Implementation code, git diffs, and commit history are collected in Phase 0 and Phase 2 (SKILL.md).
Boundary markers: The instructions specify using XML tags (e.g., <original_goal>, <constraints>, <diff>) to separate untrusted implementation data from the agent's instructions.
Capability inventory: The skill utilizes shell commands (git, gh, curl, rg) and sub-agent spawning tools (multi_agent_v1.spawn_agent).
Sanitization: No explicit escaping or filtering of the diff content is described before interpolation into the sub-agent prompt.
[COMMAND_EXECUTION]: The skill uses standard command-line tools for development workflows and quality assurance.
Evidence: Commands such as git diff, git log, gh issue list, rg, and curl -i are used to inspect the repository and test API endpoints.
[SAFE]: The skill incorporates security-positive behavior by explicitly instructing the gate reviewer sub-agent to audit for injection vectors, hardcoded secrets, and data exposure in the implementation work.

review-work