The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands (e.g., git diff <fixed-point>...HEAD, git log <fixed-point>..HEAD --oneline, git rev-parse <fixed-point>) using a fixed-point value provided by the user. If the agent's execution environment does not properly sanitize this input, a malicious user could provide a string containing shell metacharacters (such as ; or &&) to execute unauthorized commands.
[PROMPT_INJECTION]: The skill processes external untrusted content, creating a significant surface for indirect prompt injection. Ingestion points: The agent reads data from git diff output, commit messages, and various project files identified as specification sources (e.g., files in docs/, specs/, or .scratch/). Boundary markers: The instructions do not define any delimiters or explicit safety warnings to help the agent isolate and ignore instructions embedded within the diffs or specs. Capability inventory: The agent has the ability to read project files and execute Git commands based on these inputs. Sanitization: There is no mention of sanitizing, validating, or filtering the content of the diffs or specifications before they are analyzed by the review lanes.

code-review