The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of meaningful PRs, commits, and patches to provide technical reviews.
Ingestion points: The skill ingests diffs, callers, tests, contracts, and configuration files from PRs or commits (SKILL.md, references/review-workflow.md).
Boundary markers: The workflow uses a strictly defined JSON schema (references/json-review-schema.md) to structure findings. The parent reviewer instructions (templates/reviewer-output.md) explicitly warn the agent: 'Do not rely on description prose to recover a target later' and 'Never recover target metadata by reparsing prose', which serves as a mitigation against attackers embedding instructions within diff descriptions to manipulate the review metadata.
Capability inventory: The skill's primary capability is static code analysis and report generation. The instructions do not define capabilities for writing to the filesystem, executing external commands, or performing network operations beyond what the host platform provides for analysis.
Sanitization: The skill uses a multi-agent approach where specialist subagents (Security, Architecture, etc.) produce JSON partials which are then merged by a parent reviewer. This isolation helps prevent a single lens from being fully compromised by malicious content in a diff and ensures that the final output is filtered through a structured aggregation process.

change-review