The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources which can contain malicious instructions intended to manipulate the agent's behavior.\n
Ingestion points: The skill reads merge/pull request descriptions and discussions via glab, Jira issues and comments via jira, and the code diff itself (including comments) as specified in review-method.md and project-profile.md.\n
Boundary markers: The instructions do not specify any boundary markers or delimiters to separate untrusted data from system instructions, nor do they include 'ignore embedded instructions' directives.\n
Capability inventory: The agent is authorized to use git, jira, and glab CLI tools, and is explicitly encouraged to generate and run 'throwaway probe scripts' (Category 10).\n
Sanitization: There is no evidence of sanitization, validation, or escaping of the content fetched from these external sources before processing.\n- [DYNAMIC_EXECUTION]: The review-method.md file instructs the agent to verify suspected problems using 'a throwaway probe script'. This encourages the agent to generate and execute arbitrary code based on its analysis of the task and codebase, which may include untrusted input from the indirect prompt injection surface.\n- [COMMAND_EXECUTION]: The skill relies on external command-line tools to function.\n
Evidence: Instructions in project-profile.md and SKILL.md involve running git, jira issue view, and glab mr view. These tools are used to retrieve context but represent a reliance on the environment's configuration and available permissions.

top-down-review