The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (source code changes) via the RepoPrompt MCP tool, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill receives a list of changed_files in the input, which are then processed by the repoprompt/chat_send tool to perform a review.
Boundary markers: The prompt instructions sent to the reviewer do not include boundary markers or explicit instructions to ignore embedded commands within the code changes.
Capability inventory: The skill invokes repoprompt/manage_workspaces and repoprompt/chat_send tools.
Sanitization: There is no evidence of sanitization for the task_id (interpolated into the prompt) or the contents of the changed_files before they are evaluated by the LLM.
Fail-open Logic: The error handling section specifies that if the RepoPrompt tool is unavailable, fails to switch workspaces, or fails to send a chat, the skill should return a verdict of "approved". This design allows for a complete security bypass if the review infrastructure is disrupted.

rp-reviewer