The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates as an analysis engine for untrusted external code, creating a surface for indirect prompt injection where malicious instructions could be embedded in code comments or data.
Ingestion points: The skill ingests untrusted data by reading project source files, git diffs, and patches via the view_file, grep, and bash tools as defined in SKILL.md and agents/openai.yaml.
Boundary markers: There are no explicit instructions or delimiters defined to isolate untrusted code content from the agent's internal instructions, nor are there warnings to ignore embedded instructions within the analyzed data.
Capability inventory: The skill is granted significant capabilities, including bash for shell command execution and edit_file for modifying the local filesystem, particularly in the fix and receive modes.
Sanitization: The instructions do not specify any sanitization, escaping, or filtering of the ingested code content before it is processed or interpolated into the analysis prompt.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful system tools to perform its tasks.
Evidence: The skill configuration in SKILL.md and agents/openai.yaml explicitly requires access to bash and edit_file. In fix mode, the skill is instructed to write and execute tests ('write it, watch it fail, then fix') using these tools on the local filesystem.

code-review