The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of code comments and docstrings added or modified in diffs. An attacker could embed malicious instructions within these comments (e.g., in a pull request) to attempt to influence the agent's behavior.
Ingestion points: Comments and docstrings are extracted using Bash and Read tools.
Boundary markers: The skill lacks explicit delimiters or instructions to treat analyzed text purely as data and ignore any embedded directives.
Capability inventory: The skill has access to Bash and Read tools, which could be abused if an injection is successful.
Sanitization: No sanitization or escaping of the comment content is performed before analysis.
[COMMAND_EXECUTION]: The skill reconstructs shell commands for execution via the Bash tool by concatenating project metadata (SCOPE_METADATA['diff_command']) with additional flags (-U20). This creates a vulnerability surface where malicious metadata could lead to arbitrary command execution within the agent's environment.

comment-review