The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external data in the form of git diff output and source code files, which are then "literally pasted into the prompt text" for sub-agents (Breaker and API Analyst). This ingestion of untrusted data into agent prompts without explicit boundary markers or sanitization creates a surface where malicious instructions embedded in the code under review could influence the sub-agents' behavior.
Ingestion points: Untrusted code enters the process during the resolution of comparison bases (Step 2), diff gathering (Step 2), and reading of source files (Step 3).
Boundary markers: The instructions do not specify the use of delimiters or "ignore embedded instructions" warnings when interpolating code into sub-agent prompts.
Capability inventory: The orchestrator has the capability to execute shell commands (git, cat) and write to the filesystem (/tmp), while sub-agents may have workspace read access depending on the review mode.
Sanitization: There is no evidence of escaping, validation, or filtering of the external code content before it is processed by the LLM sub-agents.
Dependency on External Instructions: The skill relies on and "executes" the logic from a separate file (.claude/skills/comparison-base/SKILL.md). This creates a dependency where the core behavior of the review process (target selection) is determined by the content of another local skill file, which could be an entry point for behavioral changes if that file is modified.
Behavioral Role-Play Constraints: The skill defines specific personas for sub-agents (e.g., "Breaker" acting as a "chaos monkey") and provides strong behavioral instructions (e.g., "You are NOT here to praise good code"). While these are intended to ensure a rigorous review process, they represent a structured override of the agent's default balanced behavior.

review