The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code changes and repository configuration files, which presents a surface for indirect prompt injection attacks.
Ingestion points: The skill ingests unified diffs via git diff (Phase 0 in SKILL.md) and reads repository-local configuration files such as CLAUDE.md and CLAUDE.local.md (Conventions angle in SKILL.md).
Boundary markers: The instructions lack explicit delimiters or instructions to the AI agent to ignore or isolate potential commands embedded within the diff content or configuration files.
Capability inventory: The skill is capable of executing git commands, performing Grep searches, and utilizing an internal Agent tool for file reading and sub-task orchestration.
Sanitization: There is no evidence of sanitization, escaping, or validation of the ingested code or diff content before it is processed by the various analysis angles or the verification logic.

code-review