The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted code diffs and files which are then interpolated into subagent prompts.
Ingestion points: Untrusted repository content and diffs are collected in SKILL.md (Step 1) and placed into the {DIFF_OR_FILES} placeholder within references/reviewer-prompt.md.
Boundary markers: While the template uses markdown headers like ## Code Under Review, it lacks robust delimiters or explicit instructions for subagents to disregard instructions embedded within the analyzed code (e.g., in comments or string literals).
Capability inventory: The skill can read local files, execute shell commands via git diff, and spawn subagents to process the data.
Sanitization: There is no logic to sanitize or escape the code content before it is passed to the LLM reviewers.
[COMMAND_EXECUTION]: The skill executes git diff commands (e.g., git diff origin/main...HEAD) to identify the scope of the review. This is an expected and legitimate use of shell tools for a code review skill.

interrogate