The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from various sources, which could contain malicious instructions targeting the agent's logic.
Ingestion points: The skill reads pull request content, branch diffs, worktree files, and external prior-findings.json files as defined in SKILL.md and references/prior-findings.md.
Boundary markers: While the skill establishes comparison boundaries (merge-base to head), it lacks explicit prompt delimiters or instructions to ignore embedded natural language commands within the source code or PR descriptions being reviewed.
Capability inventory: The agent is authorized to perform network operations, run local servers, execute build/test gates, and perform "safe probes" including browser interaction and temporary tree mutations.
Sanitization: The skill demonstrates security awareness by requiring references/prior-findings.md to parse JSON as untrusted input and explicitly check for path traversal and malformed data.
[COMMAND_EXECUTION]: The skill's primary verification mechanism involves executing shell commands and project-specific tooling.
Evidence: SKILL.md instructs the agent to "Establish the repository's relevant gate from current evidence or run the missing checks" and use the "project's declared build and test tools".
Risk: If a malicious change modifies the project's build configuration (such as a Makefile, package.json script, or CMakeLists.txt), the agent may execute arbitrary code while attempting to validate the PR or run the repository gate.

code-review