The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data (git diffs) from the project being reviewed, which could contain malicious instructions designed to influence the agent's behavior during the review process or when writing to the vault.
Ingestion points: The skill reads untrusted data from the local repository using git diff main...HEAD as specified in SKILL.md.
Boundary markers: The instructions do not define explicit delimiters or boundary markers to isolate the diff content from the agent's core instructions.
Capability inventory: The agent utilizes Write and Edit tools to modify the local filesystem (Obsidian vault) and invokes the ai-commit skill to perform git operations.
Sanitization: There is no evidence of sanitization or filtering of the code diff content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill executes several shell commands to gather project metadata and branch information, which is necessary for its function but represents a standard command execution surface.
Evidence: Commands include git rev-parse, git diff, basename "$PWD", and date +%Y-%m-%d-%H%M%S in SKILL.md.

ai-code-review