The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from source code diffs and issue trackers to perform analysis. A malicious user could embed instructions within code comments or commit messages to manipulate the agent's review results or influence its behavior.
Ingestion points: The skill reads input from git diff output, git log output, and external spec files or issue trackers located at docs/agents/issue-tracker.md.
Boundary markers: The prompts generated for the parallel sub-agents do not use distinct delimiters or specific instructions to ignore embedded commands within the processed text.
Capability inventory: The agent executes shell commands (git diff, git log, git rev-parse) to retrieve the data for review.
Sanitization: No sanitization or filtering is applied to the retrieved content before it is processed by the sub-agents.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository and resolve user-supplied git references.
Evidence: It executes git diff, git log, and git rev-parse based on user-supplied 'fixed point' arguments. If the agent does not properly validate or escape the fixed-point reference, it could be vulnerable to command injection if a user provides a value containing shell metacharacters.

code-review