The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process git diffs and commit logs, which constitute untrusted data from the code being reviewed. A malicious actor could include text within code comments or commit messages intended to trick the review agent into ignoring security vulnerabilities, approving malicious changes, or bypassing review checklists.
Ingestion points: scripts/review-prep generates output containing commit logs and git diffs which are then passed to various review agents.
Boundary markers: The prompt templates in the references/ directory use placeholders (e.g., {DESCRIPTION}, {PLAN_REFERENCE}) but lack robust delimiting or explicit instructions to the model to treat the interpolated content strictly as data and ignore any embedded instructions.
Capability inventory: The skill facilitates git command execution via scripts/review-prep and references/deep-reviewer.md, and mentions browser-based audits using Playwright MCP.
Sanitization: The scripts/review-prep script performs basic character escaping for JSON formatting, but there is no semantic sanitization or filtering of the content to prevent prompt injection attacks.
[COMMAND_EXECUTION]: The skill relies on executing local shell commands. The scripts/review-prep bash script runs git rev-parse, git diff, and git log to gather context. Furthermore, the references/deep-reviewer.md prompt provides the agent with specific git commands to execute for deeper analysis.
[PROMPT_INJECTION]: The references/handling-feedback.md file contains directives that instruct the agent to override its default interactive persona by explicitly forbidding common polite responses and gratitude expressions ('NEVER: "You're absolutely right!" / "Great point!" / ANY gratitude expression'). While intended to focus on technical accuracy, this represents a deliberate override of standard model behavior constraints.

code-review