The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from code changes, diffs, and commit messages to generate security reports. An attacker could embed instructions within these sources to influence the review outcome.
Ingestion points: Data enters the context via git diff, gh pr view, and file reading commands defined in methodology.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used to isolate untrusted code content from the agent's logic.
Capability inventory: The agent has access to Bash, Write, and Grep tools as specified in the SKILL.md frontmatter.
Sanitization: There is no evidence of sanitization, validation, or escaping of the ingested code or metadata before it is interpolated into the analysis process.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to run core operations like git, grep, and gh. These commands are dynamically constructed using variables such as PR numbers, commit hashes, and branch names (e.g., git diff <base>..<head>). If these inputs are derived from untrusted external sources without sufficient validation, they could potentially be used to execute arbitrary shell commands.

differential-review