The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the git repository (including diffs, commit messages, and external issue descriptions) and interpolates them directly into prompts for sub-agents. A malicious actor could embed adversarial instructions in a pull request, commit history, or issue tracker to influence the agent's behavior during the review process.
Ingestion points: git diff output, git log output, and content fetched via docs/agents/issue-tracker.md or files in .scratch/.
Boundary markers: The skill instructions lack explicit delimiters or "ignore embedded instructions" warnings when passing diff or spec content to the sub-agent prompts.
Capability inventory: The skill executes git commands and reads local repository files.
Sanitization: No sanitization of the diff or spec content is specified before it is interpolated into the natural language prompts for the sub-agents.
[COMMAND_EXECUTION]: The skill executes shell commands (git diff, git rev-parse, git log) using a user-supplied "fixed point" (e.g., a branch name or commit hash). While these are standard git operations for this context, the user-controlled input flows into a shell command string, which is a common pattern for command injection vulnerabilities if the platform does not properly sanitize shell arguments.

code-review