The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and analyze external, untrusted content (Agent Skills in pull requests), which presents a potential attack surface for indirect prompt injection.
Ingestion points: The skill reads SKILL.md files, scripts, and reference documents from changed directories in Step 3 of the workflow.
Boundary markers: It incorporates a mandatory review-verification-protocol.md (Step 7) that requires the agent to echo source text before issuing verdicts, acting as a grounding mechanism to prevent prompt-based deception.
Capability inventory: The skill uses git diff for discovery and writes formatted review reports to a user-defined file path.
Sanitization: Includes explicit workflow steps and a dedicated verification reference file to ensure all findings are grounded in the actual code source before reporting.
[COMMAND_EXECUTION]: The skill uses shell commands to identify changes within a repository.
Evidence: Step 2 in SKILL.md defines a workflow command git diff --name-only $(git merge-base HEAD <base>)..<HEAD>. The <base> branch name is extracted from user-provided arguments, which is a standard pattern for repository-aware agent tools.

do-review-skill