The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where a subagent processes external, potentially untrusted data, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through git diff output and local project files (e.g., docs/plans/deployment-plan.md) referenced in the review process.
Boundary markers: The code-reviewer.md template lacks explicit delimiters or instructions to treat ingested data purely as data, which may allow malicious content within code comments or plan files to influence agent behavior.
Capability inventory: The reviewing agent is instructed to execute shell commands (specifically git) and perform technical assessments of the codebase.
Sanitization: No mechanisms for escaping, validating, or sanitizing the content of diffs or requirement files are implemented.
[COMMAND_EXECUTION]: The skill instructions and templates involve the execution of shell commands.
Evidence: SKILL.md and code-reviewer.md use git rev-parse, git log, and git diff to identify and analyze code changes.
Context: These commands are standard for the skill's primary purpose of code review and do not involve unusual flags or suspicious targets.

requesting-code-review