The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes findings from review reports to suggest and apply code modifications. If these reports contain malicious instructions, they could potentially trick the agent into making harmful edits.
Ingestion points: The skill reads finding details and locations from reviews/<policy-id>.md files (SKILL.md).
Capability inventory: The skill facilitates file writing, staging, and git commits (SKILL.md).
Boundary markers: There are no explicit delimiters or escape mechanisms described to prevent the agent from interpreting instructions embedded within the findings.
Sanitization: No sanitization logic is specified for the suggested fixes before they are presented for application.
Mitigation: The risk is minimized by the explicit instruction to only apply fixes on manual user confirmation and to show before/after diffs first.
[COMMAND_EXECUTION]: The skill instructs the agent to perform git operations, including staging files and executing commits with specific conventional commit messages.
Evidence: The skill specifies staging only changed files and executing fix(<container-id>): <finding title> (review) formatted commits for fixes outside the context/ directory (SKILL.md).

dx-review-triage