The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The subagent prompt template in code-reviewer.md interpolates external, potentially untrusted data—such as implementation descriptions, requirements, and commit identifiers—directly into the reviewer subagent's instructions. This configuration creates an attack surface where malicious content within the code being reviewed or the provided task description could attempt to manipulate the subagent's evaluation or bypass instructions.
Ingestion points: The [DESCRIPTION], [PLAN_OR_REQUIREMENTS], [BASE_SHA], and [HEAD_SHA] placeholders in the code-reviewer.md template.
Boundary markers: The template utilizes standard Markdown headers to demarcate data fields but lacks specific instructions for the subagent to disregard or neutralize instructions embedded within that data.
Capability inventory: The subagent is directed to use shell-based tools including git diff, git show, git log, and git worktree add to perform the review.
Sanitization: There is no evidence of validation or escaping for commit identifiers or text descriptions prior to their interpolation into the prompt.
[COMMAND_EXECUTION]: The skill instructs both the primary agent and the subagent to execute multiple shell commands, specifically git utilities, to manage the review process. While these are expected for the skill's purpose, they constitute the primary mechanism of system interaction.
Evidence: SKILL.md contains instructions for git rev-parse, git merge-base, and git log. The code-reviewer.md template instructs the subagent to execute git diff, git show, git log, and git worktree add.

requesting-code-review