The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data from external sources, such as Git pull requests, repository code, and documents. This creates a significant attack surface for indirect prompt injection where malicious instructions embedded in the reviewed artifacts could influence the behavior of the lead agent or the spawned sub-agents.
Ingestion points: The skill establishes targets from Git changes, PRs, or versioned artifacts (SKILL.md, Establish the Target).
Boundary markers: There are no explicit instructions to wrap untrusted target code in protective delimiters or warnings to sub-agents to ignore embedded instructions.
Capability inventory: The skill can read local files, spawn multiple sub-agents, and execute validation commands.
Sanitization: No sanitization or filtering of the target content is mentioned before it is passed into the sub-agent contexts (reviewer-brief.md).
[COMMAND_EXECUTION]: The workflow requires gathering and running "validation commands" and "reproducible commands" associated with the target artifact. If the artifact being reviewed is malicious, these commands could trigger arbitrary code execution within the agent's environment.
Evidence: SKILL.md instructs the agent to "Gather... validation commands" and "Report... validation commands and observed results."
[DYNAMIC_EXECUTION]: The skill dynamically spawns "independent review agents" through environment-specific execution mechanisms and optionally invokes other skills like blast-radius. This autonomous creation of processes to handle untrusted data increases the complexity of the security boundary.
Evidence: SKILL.md ("spawn independent review agents through an available agent execution mechanism") and reviewer-brief.md ("Use the blast-radius skill if available").

panel-review