The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze untrusted repository content, creating a potential surface for indirect prompt injection.
Ingestion points: The agent is directed to read the current HEAD, comparison bases, diffs, untracked files, and governing specifications (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between its internal instructions and potentially malicious instructions embedded in the code comments or documentation it reviews.
Capability inventory: The skill permits writing JSON receipts to the .scratch/ directory and executing shell commands to fulfill 'E3' evidence requirements.
Sanitization: There are no requirements for the agent to sanitize or escape data ingested from the codebase before processing it for the review report.
[COMMAND_EXECUTION]: The review workflow incorporates the execution of commands to verify the correctness of the code being reviewed.
Evidence generation: The evidence framework includes level 'E3', which specifically involves 'reproduced command, test, or observed behavior'.
Check tracking: The standardized review receipt schema explicitly includes a checks field for recording the specific shell command strings executed during the review process and their resulting status.

spine-review