The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code diffs and file contents which are interpolated into reviewer prompts. This creates an attack surface where code being reviewed could attempt to influence the LLM reviewers.
Ingestion points: SKILL.md (Step 1) gathers diffs and file contents from the repository context.
Boundary markers: references/reviewer-prompt.md uses markdown headers to separate code content, but lacks specific escaping or structured delimiters for the code block.
Capability inventory: The skill uses the Agent tool to spawn subagents and git diff for local file access. Subagents are explicitly set to readonly: true in SKILL.md (Step 3), which prevents them from making changes to the environment.
Sanitization: No sanitization is performed on the ingested code content.
[SAFE]: The skill utilizes security best practices by enforcing readonly mode on spawned subagents and provides a structured Synthesis and Judgment framework in references/lead-judgment.md to help the lead reviewer filter potential noise, hallucinations, or biased outputs resulting from the review process.

interrogate