The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted content (source code and git diffs) and interpolates it directly into prompts for reviewer sub-agents.
Ingestion points: Step 1 in SKILL.md identifies and reads files or git diffs based on the user's current context or feature branch.
Boundary markers: The references/reviewer-prompt.md template uses Markdown headers (## Code Under Review) to separate the code from the instructions, but it lacks robust delimiters (e.g., unique XML tags) or specific system instructions to the sub-agents to ignore any natural language instructions found within the code blocks.
Capability inventory: The skill uses git for context gathering and file system read operations. Sub-agents are launched in "read-only form," limiting the impact of a successful injection to the generated review findings rather than direct system compromise.
Sanitization: There is no evidence of sanitization or escaping of the code content before it is placed into the prompt template.
[COMMAND_EXECUTION]: The skill executes local git commands to gather context for the review process.
Evidence: SKILL.md (Step 1) specifies the execution of git diff main...HEAD. This is a benign use of system commands necessary for the skill's primary function of reviewing code changes.

interrogate