The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute git diff main...HEAD to identify changes in the current branch. This is a benign use of command execution necessary for the skill's primary purpose of code review.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code (the diffs or files under review) and interpolates this content into prompts for sub-agent reviewers. This creates an attack surface where instructions embedded in code comments could attempt to influence the reviewers' output.
Ingestion points: Untrusted diff data and file contents are identified in SKILL.md (Step 1) and passed to reviewers in Step 3.
Boundary markers: The references/reviewer-prompt.md template uses a ## Code Under Review section header to separate the code from the instructions, though no specific escaping is applied.
Capability inventory: The skill uses the Task tool to spawn sub-agents. These sub-agents are explicitly configured with readonly: true, which significantly limits the potential impact of a successful injection by preventing them from modifying the filesystem or environment.
Sanitization: No explicit sanitization or filtering of the user-provided code content is performed before it is passed to the sub-agents.

interrogate