The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell commands to analyze the repository state. Specifically, it executes git diff, git log, and git rev-parse to retrieve code changes and commit history for review. These are standard operations for a development-focused skill.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository and interpolates it into prompts for secondary LLM sub-agents, creating a vulnerability surface where malicious code or documentation could influence the analysis.
Ingestion points: Git diff output, commit logs, and contents of files located in docs/, specs/, or .scratch/ folders are read and passed to sub-agents (SKILL.md).
Boundary markers: While the skill specifies what content to include in sub-agent prompts, it lacks explicit instructions to use robust delimiters (such as XML tags or unique tokens) to isolate untrusted data from the prompt instructions.
Capability inventory: The skill has the capability to execute Git commands and read local files. It also references an external workflow via /setup-matt-pocock-skills.
Sanitization: There is no mention of sanitizing, escaping, or filtering the ingested code or specification text before it is presented to the sub-agents for evaluation.

code-review