The Agent Skills Directory

[COMMAND_EXECUTION]: The code-reviewer.md template instructs the subagent to execute shell commands using variables {BASE_SHA} and {HEAD_SHA} that are interpolated directly into a bash script block.
Evidence: git diff --stat {BASE_SHA}..{HEAD_SHA} and git diff {BASE_SHA}..{HEAD_SHA} in code-reviewer.md.
Risk: If these variables are manipulated (e.g., by a malicious external plan file providing a crafted string), the subagent may execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data that could contain instructions designed to subvert the agent's behavior.
Ingestion points: The {PLAN_OR_REQUIREMENTS} placeholder in code-reviewer.md is designed to ingest text from external project files like deployment-plan.md (as seen in SKILL.md).
Boundary markers: The prompt template lacks strict delimiters or "ignore embedded instructions" warnings, relying instead on simple markdown headers which provide poor isolation against adversarial text.
Capability inventory: The subagent is explicitly granted the capability to execute shell commands (git diff) and analyze code architecture and security.
Sanitization: The skill provides no mechanism for sanitizing, escaping, or validating the input data before it is placed into the prompt or used as shell arguments.

requesting-code-review