The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading git diffs and repository documentation, which could contain instructions designed to hijack the sub-agents or the main synthesis agent.
Ingestion points: git diff output, AGENTS.md, and other local repository documentation files are ingested into the prompt context for sub-agents.
Boundary markers: The skill organizes instructions into an "intent packet," but lacks explicit delimiters or instructions to ignore potential commands embedded within the diff content or documentation.
Capability inventory: The skill executes read-only git commands and file reads. It explicitly prohibits sub-agents from using state-mutating tools like apply_patch or editing files, which significantly limits the potential impact of an injection.
Sanitization: There is no evidence of filtering or sanitizing the content of the diffs or files before they are passed to the LLM sub-agents.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands to determine the scope of the review.
Evidence: The agent is instructed to use git diff, git diff --cached, and branch/commit comparison commands in SKILL.md to fetch the data required for analysis.

review-swarm