The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository and passes it directly into parallel sub-agent prompts for evaluation. This creates a surface for indirect prompt injection attacks where malicious content within the repo (e.g., in commit messages, PR descriptions, or spec files) could attempt to override the sub-agents' instructions.
Ingestion points: Commit messages retrieved via git log, diff content from git diff, issue references in metadata, and the contents of documentation/spec files in the repository (SKILL.md).
Boundary markers: Absent. The instructions do not define delimiters or specific "ignore" rules to prevent the LLM from obeying instructions embedded within the processed code or metadata.
Capability inventory: The skill executes Git subcommands (diff, log, ls-files) and reads file contents from the local filesystem (SKILL.md).
Sanitization: Absent. There is no evidence of filtering or escaping repository content before it is interpolated into the prompts for the Standards and Spec sub-agents.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the Git repository.
Evidence: The workflow explicitly uses git diff, git log, git ls-files, and git diff --cached to resolve the review scope and gather evidence for the sub-agents (SKILL.md).

afk-code-review