The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (codex exec and claude -p) using prompts that incorporate untrusted data from diffs, plans, and user messages. If this data is not properly escaped before being passed to the shell, an attacker could achieve arbitrary command execution by including shell metacharacters (e.g., semicolon, ampersand, or backticks) in the source code or messages being reviewed.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the project context and passes it directly to a secondary AI model via CLI prompts, creating an attack surface for indirect prompt injection.
Ingestion points: Data enters the process in Step 2 from 'recent diffs, referenced plans, user message'.
Boundary markers: The instructions do not define delimiters or 'ignore' instructions to wrap the untrusted content in the reviewer prompt.
Capability inventory: The skill has shell execution capabilities and local file system write access for reviewer outputs.
Sanitization: There is no mention of escaping, filtering, or validating the input data before interpolation into the sub-model's prompt.

adversarial-review