The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs and commit histories using git diff and git show. Malicious code being reviewed could contain hidden instructions designed to manipulate the agent's reporting or behavior.\n
Ingestion points: SKILL.md defines workflows that ingest output from git commands.\n
Boundary markers: Absent. There are no clear delimiters or instructions telling the agent to ignore prompt-like content within the code diffs.\n
Capability inventory: The agent can execute git commands and write to local files such as .codex/tasks/tech-debt.md.\n
Sanitization: No sanitization is specified for the content retrieved from the repository.\n- [COMMAND_EXECUTION]: The skill provides shell templates to verify commit hashes. If the agent does not properly sanitize the user-provided $TARGET variable before executing these commands, it could lead to shell command injection.\n
Evidence: SKILL.md contains a bash script block that uses git rev-parse --verify "$TARGET^{commit}" where $TARGET is a user-supplied parameter.

cc-review