The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted code diffs and file contents, which are interpolated into prompts for LLM sub-agents. This creates a surface where an attacker could attempt to embed instructions within the code to manipulate the reviewer agents. The skill mitigates this through specific instructions that constrain sub-agents to a read-only persona, though technical isolation of the input is limited.
Ingestion points: Untrusted source code files and git diff outputs are gathered in SKILL.md (Step 1) and passed to reviewers.
Boundary markers: The reviewer-prompt.md template uses standard markdown headers to separate the code from instructions but does not implement specialized isolation or escaping for the untrusted content.
Capability inventory: Sub-agents are explicitly instructed to remain read-only, are forbidden from modifying files, and are barred from calling the task tool or spawning further agents.
Sanitization: The skill does not perform explicit sanitization or escaping of the input source code before it is interpolated into the prompt templates.

interrogate