The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git commands such as git diff, git log, and git rev-parse to establish context for the code review. These are standard operations for a development tool and are used here to retrieve metadata and changes from the repository.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from git diff output, git log messages, and the content of source files which can be influenced by external actors.
Ingestion points: SKILL.md instructs the agent to read git logs, diffs, and full file contents using the Bash and Read tools. This data is then processed to perform the architectural review.
Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" warnings to prevent the agent from following directions found within code comments, commit messages, or PR descriptions.
Capability inventory: The skill allows access to Bash, Read, Glob, and Grep tools. If an injection were successful, an attacker might attempt to leverage these tools for further exploration or unauthorized file access.
Sanitization: There is no evidence of sanitization, validation, or filtering of the external code or log content before it is interpolated into the agent's context for analysis.

thermo-nuclear-code-review