The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository (code changes and plan documents) which could contain malicious instructions designed to influence the subagent's review verdict or actions.
Ingestion points: The {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, and {DESCRIPTION} placeholders in code-reviewer.md ingest external text, along with the source code retrieved via git diff.
Boundary markers: The prompt template lacks clear delimiters or 'ignore embedded instructions' directives to separate the data being reviewed from the agent's core instructions.
Capability inventory: The subagent has the capability to run shell commands (via git) and its assessment directly guides the main agent's workflow (e.g., 'Fix Critical issues immediately').
Sanitization: There is no evidence of sanitization or validation of the implementation descriptions or plan requirements before they are interpolated into the subagent's prompt.
[COMMAND_EXECUTION]: The skill relies on shell-based git commands to identify commit ranges and perform diffs. In code-reviewer.md, placeholders {BASE_SHA} and {HEAD_SHA} are interpolated directly into shell strings: git diff {BASE_SHA}..{HEAD_SHA}. If these variables are populated from untrusted input (such as a malicious branch name or user-provided reference) and not strictly validated as hexadecimal SHAs, they could be used to perform command injection.

requesting-code-review