The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a series of complex shell commands for git operations, state management, and invoking external review tools (codex, claude). It manages background processes and redirects output to files within the .git directory for persistence across sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (source code diffs and file contents) by passing it to another LLM for analysis, creating a potential vector for indirect prompt injection.
Ingestion points: Data enters via the git diff scope command and subsequent reading of full file contents referenced in the diff.
Boundary markers: Untrusted code is provided to the reviewer model via file paths or stdin; there are no explicit sanitization routines or delimiters to prevent embedded instructions in the source code from affecting the reviewer's output.
Capability inventory: The agent can write files, execute shell commands, and create git commits.
Sanitization: The skill relies on an "adversarial" persona for the reviewer and a mandatory Phase 2 manual triage by the agent/user to verify findings before any actions are taken.
[PRIVILEGE_ESCALATION]: The instructions direct the agent to request escalated permissions (such as network access and filesystem writes to ~/.claude) if it detects it is running on a sandboxed host, which is necessary for the review tools to function.

bento-adversarial-review