The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes the contents of untrusted external files. An attacker could craft a markdown or text file containing malicious instructions that the sub-agent might execute while performing its review.
Ingestion points: The content of the file specified in the <file> argument is accessed and processed by the qa-reviewer sub-agent in Step 2.
Boundary markers: Absent. The prompt used to spawn the sub-agent does not utilize XML tags, delimiters, or specific instructions to isolate the file content from the agent's task instructions.
Capability inventory: The qa-reviewer sub-agent is instructed to perform Read and Grep operations on the local file system and produce a structured qa_block report.
Sanitization: The skill only performs a basic file extension check (allowing only .md, .txt, and .markdown) but does not sanitize or filter the content of the files themselves.

check-deliverable