The Agent Skills Directory

[COMMAND_EXECUTION]: The code-reviewer.md template executes shell commands using placeholders for git commit hashes: git diff --stat {BASE_SHA}..{HEAD_SHA}. If these variables are populated with untrusted input containing shell metacharacters (e.g., ; curl ...), it could lead to arbitrary command execution. While SKILL.md instructs the agent to fetch these via git rev-parse, the template itself lacks validation.
[PROMPT_INJECTION]: The skill ingests untrusted data, specifically implementation descriptions and project plans, which are then processed by a subagent. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the code or documentation being reviewed.
Ingestion points: The {WHAT_WAS_IMPLEMENTED} and {PLAN_OR_REQUIREMENTS} placeholders in code-reviewer.md, as well as the output of the git diff command.
Boundary markers: Absent. The placeholders are directly interpolated into the subagent's instructions without delimiters or safety warnings.
Capability inventory: The agent has the ability to execute shell commands (git).
Sanitization: Absent. No escaping, validation, or filtering is performed on the external content before interpolation.

requesting-code-review