The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to facilitate the code review process.
It executes git rev-parse to retrieve commit identifiers (SHAs).
It executes git diff and git diff --stat to analyze changes between commits.
These operations are limited to reading repository metadata and diffs, which is standard behavior for development-oriented tools.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from implementation summaries, requirements, and source code diffs.
Ingestion points: Data enters the agent context via the {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, and git diff output parameters in code-reviewer.md and SKILL.md.
Boundary markers: The prompt template uses markdown headers to separate sections, though it lacks explicit instructions to ignore embedded instructions within the ingested data.
Capability inventory: The subagents are granted the ability to read the git repository and suggest fixes. The task-bug-fixer is intended to apply code changes.
Sanitization: No explicit sanitization of the input text is performed.
Risk Assessment: The risk is low as the subagent's primary role is to critically analyze the code, and the skill includes specific constraints to prevent subagents from performing high-risk actions like spawning additional subagents.
[SAFE]: Several security best practices are implemented within the skill instructions:
Session Isolation: The skill supports a SCRATCHPAD_DIR to ensure that parallel planning/execution sessions do not collide, preventing cross-session data leakage or corruption.
Recursion Prevention: The instructions explicitly forbid nested subagents (Do not dispatch or invoke any subagents), which mitigates the risk of uncontrolled resource consumption or execution loops.

requesting-code-review