The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run the command git diff "$(git merge-base "$BASE_REF" HEAD)"..HEAD. By directly interpolating the $BASE_REF variable into a shell command, the skill creates a potential command injection vulnerability if the variable is populated from untrusted sources like user-controlled branch names or PR metadata.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes external, untrusted code diffs that could contain malicious instructions designed to manipulate the agent's behavior or its subagents.
Ingestion points: The agent ingests data from git diff output across all files in a branch.
Boundary markers: The skill lacks explicit delimiters or instructions to treat the code content as data rather than instructions, which increases the likelihood of the agent following instructions embedded in code comments or logic.
Capability inventory: The skill possesses the capability to spawn and manage up to 10 parallel subagents, which could be leveraged if the main agent's instructions are subverted.
Sanitization: There is no evidence of content filtering, escaping, or validation of the ingested code changes before they are processed by the LLM.

ha-review