The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted code from a repository (via git diff and file gathering in Step 1), creating a potential surface for indirect prompt injection attacks where the code being reviewed could contain instructions that influence the agent's behavior.
Ingestion points: The skill reads local file contents and the output of git commands from the user's current repository.
Boundary markers: The references/reviewer-prompt.md template uses standard markdown headers like ## Code Under Review to wrap the content, but it lacks specific instructions for the subagent to treat that content strictly as data or to ignore any embedded directives.
Capability inventory: The skill uses delegate_task to spawn subagents and various file system/git read commands. The instructions specify that subagents should be 'read-only', limiting their potential to perform actions even if compromised.
Sanitization: No sanitization or escaping is performed on the code content before it is interpolated into the {DIFF_OR_FILES} placeholder.
Mitigation: The skill mandates that the user remains in the loop by explicitly stating 'Do NOT auto-apply changes' and positioning the primary agent as a senior reviewer who must interpret and categorize findings.

code-review-panel