The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests untrusted project data to configure the prompts and parameters of its generated review skill. Maliciously crafted content in project documentation or configuration files could potentially influence the behavior of the review agents.
Ingestion points: The generator scans the repository for README.md, CLAUDE.md, specifications, and task boards. These files are read and processed in Phase 1 and Phase 3 of the generation flow.
Boundary markers: The skill relies on natural language instructions and table structures to separate project data from agent instructions. It lacks strictly isolated data boundaries.
Capability inventory: The generated skill possesses capabilities including the ability to execute shell commands (Bash) for project build/test gates, write files (Write), and coordinate other agents (Agent).
Sanitization: While the generator script performs basic character escaping for scalar placeholders during template substitution, block-level content incorporated during the AI-driven adaptation phase relies on the model's reasoning and does not undergo programmatic sanitization.
[DYNAMIC_EXECUTION]: The skill is a generator that dynamically creates and modifies executable instructions (SKILL.md and agent files) within the target project's environment.
Generation logic: It uses a template-based approach where project-specific facts (like stack labels and path globs) are substituted into predefined instruction sets. It also employs an 'AI Edit' phase to populate more complex blocks like domain routing tables and evidence commands.
Evidence: The scripts/generate.sh script manages the lifecycle of these artifacts, performing copying, substitution, and validation checks. The generated skill itself includes a 'self-sync' mechanism that allows it to update its own routing and configuration based on changes to the project's agent roster.

superreview-setup