The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to take user-supplied input (the 'fixed point') and interpolate it directly into several Git shell commands: git rev-parse <fixed-point>, git diff <fixed-point>...HEAD, and git log <fixed-point>..HEAD. There are no instructions for the agent to sanitize or validate this input, allowing a malicious user or a malicious source suggesting a reference to execute arbitrary commands (e.g., using command chaining like main; curl ...).
[INDIRECT_PROMPT_INJECTION]: The skill identifies and processes untrusted data from multiple sources to perform its review, creating a significant surface for indirect prompt injection.
Ingestion points: The agent ingests data from file contents (docs/, specs/, .scratch/), Git diff outputs, commit messages, and external issue descriptions via docs/agents/issue-tracker.md.
Boundary markers: The prompts defined for the 'Standards' and 'Spec' sub-agents do not include any delimiters (like XML tags or markdown blocks) or instructions to ignore embedded commands within the data being reviewed.
Capability inventory: While the sub-agents primarily generate text reports, they have the capability to influence the final output provided to the user, which could be used to hide malicious changes or provide false safety assurances.
Sanitization: No sanitization, escaping, or validation logic is defined for the external content before it is passed into the sub-agent prompts.

code-review