The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of code snippets and git diffs, creating an attack surface where instructions embedded in the code could influence agent behavior.
Ingestion points: scripts/collect_diff.sh (reads git diffs) and user-provided snippets.
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or ignore instructions within the reviewed data.
Capability inventory: The skill uses git, npm, npx, ruff, mypy, and pytest via subprocess calls.
Sanitization: Absent. No validation is performed on the code before it is processed or used in test executions.
[COMMAND_EXECUTION]: The skill directs the agent to run local shell commands, including test suites, which could lead to code execution if the reviewed code is malicious.
Evidence: SKILL.md instructs the agent to run npm test and pytest. Executing tests on untrusted code is a known vector for arbitrary code execution.

code-review