The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted source code and project metadata to generate findings and an executable fix plan. This creates a surface for indirect prompt injection attacks.
Ingestion points: The explore agent (Phase 1) and code-reviewer agents (Phase 2) read files from the local filesystem that may contain malicious instructions in comments, documentation, or metadata. Specifically, the explore agent is tasked with identifying "Gatekeeping Commands" which are later incorporated into the fix plan.
Boundary markers: No boundary markers or "ignore previous instructions" warnings are used when interpolating untrusted data from source files into the prompts for subagents.
Capability inventory: The final fix-plan.md is designed to be "directly executable" by the subagent-orchestration skill. This skill likely has the capability to modify the filesystem and execute shell commands (e.g., gatekeeping commands like build or typecheck).
Sanitization: There is no evidence of sanitization, validation, or escaping of the content ingested from the source files before it is used to generate the actionable fix plan.

subagent-review