The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from source code changes without sufficient isolation or instruction filtering.\n
Ingestion points: The skill reads untrusted data from git diff main..HEAD in Step 2 and existing review files from git show origin/reviews:reviews/PR-<N>.md in Step 3.\n
Boundary markers: No explicit delimiters or system instructions are provided to the agent to prevent it from following commands potentially embedded in the code being reviewed.\n
Capability inventory: The skill has permissions to write files locally and use git push to publish content to a remote branch.\n
Sanitization: There is no evidence of sanitization or escaping of the diff content before it is processed by the model.\n- [COMMAND_EXECUTION]: The skill uses low-level git plumbing commands to manipulate the repository state.\n
Evidence: In Step 4, the skill employs git hash-object, git mktree, and git commit-tree to build and push commits directly. While documented as a workaround for specific filesystem constraints (CIFS/SMB), these commands allow the agent to bypass standard porcelain commands like git commit and directly manipulate the repository's object database.

mps-review