The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform a 'fresh review' by executing shell commands or spawning sub-agents. It provides specific examples of commands to run, such as codex exec --ephemeral --sandbox read-only -o verdict.md and claude -p --no-session-persistence > verdict.md. The instructions direct the agent to 'look through your tools for one that runs a worker, subagent, or command and returns its output, and use that.'
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, potentially untrusted data such as session transcripts, logs, CI runs, PR descriptions, and files to establish the cause of a problem. If these records contain malicious instructions, they could potentially influence the agent or the sub-agent performing the review.
Ingestion points: Records including session transcripts, instructions, loaded skills, logs, CI runs, process/lock state, and PR descriptions (mentioned in SKILL.md).
Boundary markers: Explicit boundary markers or 'ignore' instructions for the initial ingestion of record data are absent. The 'packet' for the fresh review phase uses a structured format but does not include sanitization markers.
Capability inventory: The skill utilizes file read capabilities and the ability to execute commands/sub-agents (e.g., codex exec, claude -p) as described in SKILL.md and references/fresh-review.md.
Sanitization: No sanitization, escaping, or filtering of the content from the external records is specified before it is processed or passed to the reviewer.

deep-dive