The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the repository which could contain malicious instructions. (1) Ingestion points: Step 5 aggregates output from git diff and the raw contents of all untracked files into a single input file. (2) Boundary markers: The prompt provided to subagents in Step 7 lacks explicit delimiters or instructions to ignore potential commands embedded within the diff or file contents. (3) Capability inventory: The orchestrator executes shell commands and local Python scripts, while subagents are granted file system read access to verify findings. (4) Sanitization: Content from the repository is aggregated into the analysis input without validation, filtering, or escaping.
[COMMAND_EXECUTION]: The skill executes a sequence of local Python scripts, such as preflight.py and init_run.py, located in a peer directory relative to the skill path.
[EXTERNAL_DOWNLOADS]: The skill utilizes uv run to dynamically install well-known libraries including scikit-learn, scipy, and numpy from an external registry to facilitate finding analysis.

review-diff