The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (codex exec and claude) that include untrusted content, such as code diffs and user messages, as command-line arguments. If the external content contains shell metacharacters like backticks, semicolons, or unmatched quotes, it could lead to arbitrary command execution on the host system. The specific instruction to use --skip-git-repo-check further suggests a bypass of potential built-in security checks performed by the tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from recent diffs, plans, and user messages (SKILL.md, Step 2) and interpolates it into prompts for secondary models, creating a significant attack surface for indirect prompt injection. Analysis of the mandatory evidence chain shows:
Ingestion points: Untrusted code diffs and plan references enter the agent's context in Step 2.
Boundary markers: The reviewer prompt template in Step 3 does not employ robust delimiters or explicit instructions to prevent the model from obeying instructions embedded within the code being reviewed.
Capability inventory: The skill has the ability to execute shell commands, perform filesystem operations in /tmp, and synthesize results from local files.
Sanitization: There is no evidence of sanitization or escaping of untrusted content before it is used as a CLI argument.
[DYNAMIC_EXECUTION]: The skill involves runtime generation of prompt content and its execution through external CLI processes. It also utilizes temporary directories (/tmp/adversarial-review.XXXXXX) to store and retrieve data, which are then parsed to generate a final synthesized verdict.

adversarial-review