The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly instructs subagents to perform security reviews that involve accessing sensitive credentials and configuration files. Specifically, code-reviewer.md includes '密钥和凭据管理评估' (Credential and secret management assessment), '环境特定配置验证' (Environment-specific configuration verification), and '密钥和凭据安全审查' (Secret and credential security review). While this is consistent with a security audit persona, it constitutes a high-risk data exposure pattern as the subagent is encouraged to read files like .env or configuration manifests that may contain active secrets.
[COMMAND_EXECUTION]: The skill leverages powerful system tools to perform its functions. SKILL.md specifies that the subagent '自己拥有 Bash、Read 等工具' (has its own Bash, Read, and other tools) and will '自行读取代码和 diff' (read code and diffs by itself). The subagent's prompt in code-reviewer.md further directs it to use various CLI tools such as SonarQube, CodeQL, Semgrep, Snyk, Bandit, npm audit, and pip-audit. The ability to execute arbitrary shell commands for analysis purposes increases the attack surface if the agent is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is inherently vulnerable to indirect prompt injection because its primary function is to ingest and process untrusted external data (source code and git diffs).
Ingestion points: The subagent reads the target codebase and git diffs (e.g., git diff --cached) as specified in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to treat the ingested code as data only; the user requirements are simply appended to the code-reviewer.md prompt.
Capability inventory: The subagent has access to Bash and Read tools, which can be used to execute commands or access the wider filesystem if triggered by malicious instructions found within the code under review.
Sanitization: There is no evidence of sanitization or filtering of the code content before it is processed by the subagent.

code-reviewer-agent