The Agent Skills Directory

[COMMAND_EXECUTION]: The template file code-reviewer.md contains shell command blocks that directly interpolate placeholders such as {BASE_SHA} and {HEAD_SHA}. If these variables are populated with unvalidated or malicious input (e.g., from a compromised plan file or branch name), it could lead to arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is inherently exposed to indirect prompt injection because it processes untrusted data.
Ingestion points: The agent reads external content via git diff and plan/requirement files specified in {PLAN_OR_REQUIREMENTS}.
Boundary markers: The code-reviewer.md template does not utilize clear boundary markers or safety instructions to distinguish between the agent's instructions and the content being reviewed (the code diff).
Capability inventory: The skill executes git commands and provides a merge readiness assessment, which could be manipulated by hidden instructions in the code changes.
Sanitization: The skill lacks any mechanism to sanitize or escape the content retrieved from the repository before it is processed by the LLM.
[DYNAMIC_EXECUTION]: The sub-agent template mechanism in code-reviewer.md relies on the runtime assembly of executable bash commands through string interpolation of placeholders. This pattern facilitates the execution of dynamically generated scripts without sufficient validation of the injected components.

review-merge-readiness