The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extracts a commit SHA from the $ARGUMENTS variable and interpolates it directly into shell commands, specifically git diff --name-only <base-commit>. If the platform's shell execution environment does not strictly prevent command chaining (e.g., via ;, &&, or ||), a malicious user could provide a crafted argument to execute arbitrary code. Although the allowed-tools frontmatter attempts to restrict the command prefix, it may not be sufficient to block sophisticated shell-based attacks.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks (Category 8). It ingests untrusted data from the repository, including contents of .claude/rules/**/*.md and the output of git diff. This data is then interpolated into prompts for sub-agent reviewers using headers like ## Rules to Check and ## Diff to Review. A malicious actor could commit files to the repository containing hidden instructions designed to override the reviewer's safety guidelines or manipulate its findings. No sanitization or escaping is performed on the ingested content before it is passed to the sub-agent.

rules-review