The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external content such as pull requests, repository diffs, and entire codebases. There are no explicit instructions to treat this content as purely passive data or to use specific delimiters to prevent the agent from following instructions embedded within the reviewed code.
Ingestion points: Processes repository diffs, PRs, and codebases as specified in the description and Workflow sections of SKILL.md.
Boundary markers: No specific delimiters or 'ignore embedded instructions' warnings are provided for the content being reviewed.
Capability inventory: The skill has permissions to write files to the repository (adrs/work/), delegate tasks to subagents (use-subagents), and perform validation which may include package installation.
Sanitization: No sanitization or escaping of the ingested code/PR content is mentioned before it is processed by the agent.
[REMOTE_CODE_EXECUTION]: The skill guidelines in references/review-dimensions.md suggest that the agent should 'Dry-run package artifact; install in clean temp consumer when practical.' for validation. This instruction directs the agent to execute or install code derived from the untrusted repository being reviewed, which could result in arbitrary code execution if the package contains malicious hooks (e.g., preinstall or postinstall scripts).

code-review