The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted external data such as 'companion specs', 'tasks', and 'code diffs' to drive its decision-making logic.
Ingestion points: Files located in the repository or working directory, including specifications and implementation history.
Boundary markers: Absent. There are no instructions for the agent to ignore or delimit instructions that might be embedded within the reviewed code or markdown files.
Capability inventory: The agent has the ability to read files, write artifacts to the user's home directory, and execute shell commands for verification.
Sanitization: None. The skill does not mention escaping or validating the content of the specs or diffs before processing them.
[COMMAND_EXECUTION]: The instructions require the agent to 'Rerun every applicable verification after the final relevant change.' This involves executing arbitrary commands or test suites defined within the target codebase, which could lead to the execution of malicious scripts if the repository being reviewed is compromised.
[COMMAND_EXECUTION]: The 'Close' logic instructs the agent to 'Delete every selected path and verify absence' upon human disposition. This grant of file deletion capability, while human-gated, represents a significant privilege that could be abused if the agent's context is manipulated.
[DATA_EXFILTRATION]: The skill writes review artifacts and 'frozen target state' data to ~/.agents/artifacts/<workspace>/. Accessing and writing to directories outside the project root using absolute paths derived from the user's home directory involves a risk of data exposure, particularly if the <workspace> name or the files being reviewed contain sensitive information.

sus-review