The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit directives to override or ignore specific instructions from the platform ("Ignore Claude-specific mode-switch instructions when they appear"). It also mandates a "Strict execution contract," which is an attempt to lock the agent's behavior against future modifications or safety constraints.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the repository's source code and version control system.
Ingestion points: SKILL.md (Step 0) utilizes git diff and git status to determine the review scope.
Boundary markers: Absent. The skill does not provide clear delimiters to ensure the LLM distinguishes between the code being reviewed and the review instructions.
Capability inventory: The skill has the ability to modify the filesystem by executing $workflow-review-changes, which applies fixes to the code.
Sanitization: Absent. There is no evidence of filtering or escaping logic for the content of the diffs before they are processed by the LLM.
[COMMAND_EXECUTION]: The skill uses shell commands to manage its workflow, including git status, git diff, and git rev-parse. These are used to snapshot the working tree and calculate review scopes.

workflow-review-changes-loop