The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the backend implementation files being reviewed.
Ingestion points: The skill reads backend implementation files, diffs, and OpenAPI configuration files.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the ingested code as data only or to ignore any instructions found within those files.
Capability inventory: The skill utilizes Bash, Task, and Write tools, providing a broad capability set that could be exploited if malicious code within the analyzed implementation successfully influences the agent's behavior.
Sanitization: The skill does not mention any sanitization, validation, or filtering of the external code content before it is processed by the agent.

backend-review