The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from code comments and documentation, which could potentially contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: Reads content from files, directories, and git diffs (via branches or PR numbers) as specified by the $ARGUMENTS variable in SKILL.md.
Boundary markers: The skill instructions do not specify any delimiters or safety markers to differentiate the data being reviewed from the agent's own instructions.
Capability inventory: The agent has the ability to modify the filesystem by deleting or rewriting prose in target files when the --fix argument is provided.
Sanitization: There are no explicit instructions for sanitizing or validating the content of the comments before they are analyzed and acted upon by the agent.

prose-review