The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a "permission rule" that explicitly instructs sub-agents to fetch and quote live cloud infrastructure policy documents (e.g., IAM roles, KMS key policies, and storage bucket policies) from the live system into their reports. This practice results in the exfiltration of sensitive security configuration metadata into the AI's conversation history and logs.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves processing untrusted external data, which creates a significant injection surface.
Ingestion points: The skill ingests git diffs, commit messages, and external specification files (read from docs/, specs/, or .scratch/ folders or fetched from issue trackers).
Boundary markers: The instructions lack delimiters or explicit "ignore embedded instructions" warnings when passing this untrusted data to sub-agents.
Capability inventory: The process requires agents with shell access (to execute git and gh commands) and provides the agent with the ability to write code modifications during the "Fix round" (Step 7).
Sanitization: There is no evidence of sanitization or validation of the content within the git diffs or specification files before they are interpolated into sub-agent prompts.
[COMMAND_EXECUTION]: The skill relies on shell-capable agents to execute a variety of system commands, including git diff, git log, git rev-parse, and GitHub CLI (gh) operations. While these are necessary for the skill's functionality, the execution of shell commands in an environment where untrusted diff data is being analyzed increases the overall risk of command injection.

code-review