The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data, which could contain malicious instructions designed to manipulate the agent's behavior during the review or implementation phases.
Ingestion points: The skill reads git diff output, PR bodies (spec), and issue descriptions to guide the review process (found in the 'Loop' and 'Reviewer brief' sections).
Boundary markers: The prompt uses XML tags (<role>, <constraints>, etc.) to structure instructions, but does not include explicit delimiters or 'ignore embedded instructions' warnings for the data being analyzed.
Capability inventory: The skill has the ability to write to the filesystem (via the Implementer sub-agent), execute repository scripts (package.json scripts), and run Playwright CLI for browser-based testing.
Sanitization: There is no evidence of string sanitization or filtering for the external data before it is interpolated into the sub-agent prompts.
[COMMAND_EXECUTION]: The skill invokes several command-line tools and repository-specific scripts, which could be exploited if the environment or inputs are compromised.
Evidence: The skill explicitly runs git diff, Playwright CLI, and shell scripts defined in the root package.json. It also utilizes $ARGUMENTS, which represents a potential injection point depending on how the host platform handles variable expansion.

review-pr