The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted artifacts, including code, diffs, and design documents, for review by sub-agents. This creates a surface for indirect prompt injection where instructions embedded in the artifact could attempt to influence the reviewer's judgment or the lead agent's verification logic.
Ingestion points: Artifact paths and content specified in the review packet (SKILL.md, assets/review-packet.template.md).
Boundary markers: The review packet template uses specific headers and instructions ("You are reviewing an artifact you did not write... Report what you find") to delineate the untrusted content, though these are natural language boundaries.
Capability inventory: The skill allows for applying fixes (file-write) and running verification checks (subprocess execution of entry points or validators) based on findings.
Sanitization: The skill relies on the lead agent to manually verify citations and evidence in the artifact before taking action, rather than automated sanitization.
[DYNAMIC_EXECUTION]: To adjudicate findings, the lead agent is instructed to run "the cheap check that would show the problem, such as an entry point on fixed input" (SKILL.md). This involves executing code from the reviewed artifact. While the instructions emphasize using read-only sandboxes for reviewers and limited scopes for fixes, executing arbitrary code from an untrusted artifact at runtime carries inherent risk.

review-panel