The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files and repository history, which is then passed to sub-agents for analysis. Malicious instructions embedded in code comments, commit messages, or specification files could potentially influence the sub-agents' behavior.
Ingestion points: The skill reads output from git diff and git log, as well as the contents of specification files located in directories like docs/, specs/, or .scratch/ (Step 2 and Step 4).
Boundary markers: The instructions do not define clear delimiters or "ignore instructions" warnings when passing this external content to the parallel sub-agents.
Capability inventory: The skill possesses filesystem access, shell command execution capabilities (via git), and the ability to spawn sub-agents.
Sanitization: No explicit sanitization or filtering of the ingested diff or spec content is mentioned before it is interpolated into the sub-agent prompts.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with the version control system, including git diff, git log, and git rev-parse (Step 1). These commands are used as intended for repository analysis and do not incorporate unvalidated external input into the command structure itself.

code-review