The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from code diffs and GitHub issue/PR bodies, which are passed directly into sub-agent prompts. This allows malicious instructions in the code or issue descriptions to potentially manipulate the sub-agents' review findings.\n
Ingestion points: The skill reads diff output via git diff and fetches external content using gh issue view and gh pr view as described in SKILL.md.\n
Boundary markers: The instructions for the Standards, Spec, Simplification, and Optimization sub-agents lack explicit delimiters or "ignore" instructions to prevent the model from obeying embedded commands in the diff or spec data.\n
Capability inventory: The skill executes read-only git and gh commands and reads local documentation. It does not have file-writing capabilities or the ability to make arbitrary network requests.\n
Sanitization: No validation or sanitization of the content from the diff or the GitHub CLI is mentioned before it is interpolated into prompts.\n- [COMMAND_EXECUTION]: The skill constructs shell commands using variables derived from sources that can be influenced by users or attackers.\n
Evidence: In SKILL.md, the <fixed-point> argument for git diff and git rev-parse is provided by the user. Furthermore, the issue <number> used in gh issue view is extracted from commit messages, which are part of the repository data and could contain shell metacharacters for command injection.

code-review