The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes code diffs and pinned ranges from Git repositories, which are untrusted external inputs. Malicious code changes could contain hidden instructions designed to influence the behavior of the reviewer models during the automated review process.
Ingestion points: The skill ingests commit ranges via Git operations in SKILL.md (Step 1 and Step 3).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the code content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill leverages delegate_task with full-access permissions and permits shell command execution for auditing purposes (e.g., test-audit).
Sanitization: No sanitization, escaping, or validation of the ingested code content is performed before delivery to delegated review models.
[COMMAND_EXECUTION]: The references/review-brief.md file instructs the agent and delegated reviewers to 'Run every shell command in the foreground and wait for it to finish.' This gives the agents broad permission to execute scripts or commands found within the codebase being reviewed, which could be exploited if the codebase contains malicious scripts.

review-it