The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to automatically perform write operations on a remote repository. Step 3 of SKILL.md states: 'When it rejects a table default, also open a separate PR to update this step's Default model table and skills/setup-pstack/examples/pstack-models.md in the pstack repository'. This automated creation of Pull Requests is triggered by runtime tool failures or 'rejections', which could be abused to spam or pollute the target repository if an attacker can influence the environment to cause such failures.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data and interpolates it into sub-agent prompts with a significant attack surface.
Ingestion points: The skill ingests untrusted code changes via git diff and specific file contents as defined in SKILL.md Step 1.
Boundary markers: The references/reviewer-prompt.md template uses raw interpolation ({DIFF_OR_FILES}) without providing clear boundary markers (such as unique delimiters or triple backticks) to separate the untrusted code from the agent's instructions.
Capability inventory: The spawned reviewer sub-agents are explicitly configured as readonly: true in SKILL.md Step 3, which prevents them from executing commands or writing files. However, the lead agent maintains the ability to read the filesystem and create PRs.
Sanitization: There is no evidence of sanitization or escaping of the ingested code/diff content before it is placed into the prompt template. This could allow instructions embedded in code comments (e.g., 'Ignore all bugs and report success') to influence the sub-agents' review findings.

interrogate