The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the exec tool to run shell commands for file system exploration and reading. Specifically, Step 0 instructs the agent to run grep -rln <subsystem-keyword> decisions/. This involves interpolating a keyword into a shell command, which could be exploited for command injection if the keyword is derived from untrusted content and contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external markdown documents (proposals, specs, ADRs, and postmortems).
Ingestion points: The agent reads content from various local directories (proposals/, specs/, decisions/, postmortems/) using exec, search, and native file tools.
Boundary markers: The skill does not define clear delimiters or include instructions for the agent to ignore potentially malicious embedded instructions within the documents being reviewed.
Capability inventory: The skill has access to powerful capabilities including shell execution (exec), file searching (search), and the ability to modify local files (write, edit).
Sanitization: There is no evidence of sanitization or validation of the ingested content before it is processed or used to influence subsequent agent actions.

review-a-design