The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses user-provided input (the 'fixed point') directly in shell commands such as git diff <fixed-point>...HEAD, git log <fixed-point>..HEAD, and git rev-parse <fixed-point>. If the agent platform does not sanitize these arguments, it could lead to arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill ingests untrusted data from git diffs, commit messages, and external issue trackers/specifications, which is then passed into the prompts of parallel sub-agents. This creates a surface for indirect prompt injection attacks where malicious code or comments could manipulate the reviewer's behavior.
Ingestion points: Untrusted content enters via git diff, git log, and the contents of spec files located in docs/, specs/, .scratch/, or fetched from external issue trackers.
Boundary markers: The instructions for the sub-agents do not include robust boundary markers or specific guidance to ignore instructions embedded within the code or specifications being reviewed.
Capability inventory: The skill is capable of executing shell commands and spawning sub-agents with broad access to the repository context.
Sanitization: There is no evidence of sanitization, filtering, or validation for the external data and diff content before it is processed by the AI sub-agents.

code-review