The Agent Skills Directory

[COMMAND_EXECUTION]: The code-reviewer.md file defines a subagent template that executes shell commands using values from the {BASE_SHA} and {HEAD_SHA} placeholders. These placeholders are directly interpolated into git diff commands without sanitization or validation. If these values are derived from untrusted input (e.g., a user-provided string containing shell metacharacters like semicolons or backticks), it allows for arbitrary command execution within the subagent's environment.
[INDIRECT_PROMPT_INJECTION]: The reviewer subagent processes external data, including requirements, implementation descriptions, and the actual code changes, as part of its prompt context. The template lacks boundary markers (such as XML tags or explicit delimiters) or instructions to ignore embedded commands within the reviewed content. This makes the subagent vulnerable to malicious instructions hidden in the code or documentation being reviewed.
Ingestion points: Data enters the subagent context via {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, {DESCRIPTION}, and the output of git diff in code-reviewer.md.
Boundary markers: No delimiters or isolation markers are present in the template.
Capability inventory: The subagent has the capability to execute subprocess calls (git diff) and generate textual assessments.
Sanitization: No escaping or validation is performed on the content interpolated into the prompt.

requesting-code-review