The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository's git diffs, commit messages, and specification documents. These inputs are passed into the prompts of sub-agents without explicit sanitization, creating a surface for indirect prompt injection where malicious comments in the code could attempt to influence the review results.
Ingestion points: The skill ingests data from git diff, git log, and files located in docs/, specs/, or .scratch/ paths.
Boundary markers: The sub-agent prompts use descriptive sections (e.g., "The full diff command and commit list") but do not include explicit instructions to the sub-agent to ignore instructions embedded within the data itself.
Capability inventory: The skill has the capability to execute shell commands (git) and read arbitrary files within the repository scope.
Sanitization: There is no evidence of sanitization or filtering applied to the diff or spec content before it is interpolated into the sub-agent prompts.
[COMMAND_EXECUTION]: The skill executes shell commands to retrieve information from the local git repository.
Evidence: The instructions in SKILL.md specify the use of git diff, git log, and git rev-parse to identify changes and resolve references.

code-review