The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its discovery mechanism for configuration files.
Ingestion points: The agent is instructed in SKILL.md to walk up the directory tree from a changed path to the filesystem root to find and read AGENTS.md files, and to follow links to external documents named in those files.
Boundary markers: The instructions lack explicit boundary markers or warnings to disregard instructions embedded within these external documents, relying instead on a reconciliation process that assumes the sources are authoritative.
Capability inventory: The agent uses filesystem read operations, VCS inspection tools, and rendered interface inspection via browsers or emulators.
Sanitization: No sanitization or validation of the content within AGENTS.md or linked documents is performed before the agent adopts their review policies.
[DATA_EXFILTRATION]: The skill performs filesystem traversal that exceeds the boundaries of the target repository.
Evidence: In SKILL.md, the instructions state: 'For each changed path, discover applicable AGENTS.md files by walking from the filesystem root through every parent directory, including ancestors above the VCS root.' This behavior allows the agent to access and process files located in system-wide or user-wide directories that are not part of the codebase being reviewed, potentially exposing sensitive data if an AGENTS.md file exists in those locations.

ui-ux-reviewer