The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted code diffs and passes them directly to sub-agents.
Ingestion points: The skill reads external content from gh pr diff, git diff, and user-provided inline diff content.
Boundary markers: The skill uses markdown headers and field labels (e.g., **Diff source:**) to structure the prompts, but it lacks explicit instructions to the sub-agents to ignore instructions or adversarial patterns embedded within the code diffs themselves.
Capability inventory: The skill executes shell commands (git, gh) and spawns specialized sub-agents (correctness-reviewer, security-reviewer, etc.) via the task tool, passing the untrusted diff data into their context.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the diff content before it is interpolated into the prompts for the sub-agents.
[COMMAND_EXECUTION]: The skill executes shell commands such as gh pr diff <N> and git diff <base>..<HEAD>.
Command Injection Surface: If the user-supplied PR number (N) or branch references (base, HEAD) are not properly validated or sanitized by the underlying agent platform, they could be exploited for command injection (e.g., providing a PR number like 42; rm -rf /).

code-reviewer