The Agent Skills Directory

[Indirect Prompt Injection]: The skill ingests untrusted data from git diffs and full file contents for review by subagents.
Ingestion points: Step 1 and Step 2 describe reading git diff output and the full current content of every changed file into the context block (00-context.md).
Boundary markers: The skill uses instructional directives in subagent prompts to focus on specific perspectives, but lacks strong delimiters or 'ignore' instructions for the code content being processed.
Capability inventory: The skill spaws multiple subagents (LLM calls), writes review artifacts to the filesystem (.copilot/), and executes project test suites.
Sanitization: No explicit sanitization or filtering of the code content is described before it is processed by the reviewer subagents.
[Command Injection Risk]: The skill uses user-supplied branch names and merge targets directly in shell commands.
Evidence: Step 1 executes git diff <merge-target>...<branch> where these values are provided by the user via the argument-hint. If these inputs are not sanitized, they could potentially be used to append or inject additional shell commands.
[Dynamic Execution of Project Code]: The skill instructs the agent to run project-specific tests during the remediation phase.
Evidence: Step 7 ('Apply Fixes') and Step 8 ('Check Exit or Re-review') involve running the project's test suite to verify fixes. If the branch under review contains malicious test code, it would be executed on the local system.

branch-review