The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reviews code changes by passing diff output to an AI subagent. Malicious code comments or commit messages in the diff could be used to inject instructions aimed at misleading the subagent into suggesting harmful fixes or generating deceptive comments.
Ingestion points: SKILL.md orchestrates the retrieval of code diffs into patch files (Step 1).
Boundary markers: Delimiters are used in the prompt template (references/code-review-prompt.md), but there are no explicit instructions for the model to ignore or escape instructions contained within the diff content itself.
Capability inventory: The skill has the authority to modify the working directory (--fix) and post comments to pull requests (--comment).
Sanitization: references/finding-anchors.js verifies the physical location of findings (line numbers), but the content of the suggestions is not sanitized for malicious logic.
[COMMAND_EXECUTION]: The workflow relies on shell commands (git, gh, node, awk) and interpolates variables derived from user-provided targets like PR numbers and branch names.
Evidence: SKILL.md contains bash snippets for resolving pull request bases and generating patches. Although helper scripts like references/pr-inline-comment.js perform regex validation on PR numbers, the overall orchestration relies on the agent's safe construction of commands.
[CREDENTIAL_UNSAFE]: The skill handles sensitive credentials for Bitbucket, Jira, and GitHub, reading from environment variables and local files like .env and .secrets/tooling.env.
Evidence: references/bb-auth.js and references/bitbucket-auth.sh facilitate the construction of authorization headers.
Mitigation: A sophisticated redaction system in references/defer-mutation.js identifies and masks secrets (using environment sweeps and pattern matching) to prevent accidental exposure in logs and handover documentation.

review-code