The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and analyze untrusted data, such as source code, git diffs, and repository instructions. This creates a significant surface for indirect prompt injection, where maliciously crafted comments or code within a reviewed file could attempt to manipulate the agent's behavior or reporting.
Ingestion points: SKILL.md (Phase 1: UNDERSTAND), Mode 3: Full-Repo Review (Step 1: Discover and Pre-check), and the checklists in references/audit-playbook.md which scan all source files.
Boundary markers: The instructions lack explicit boundary markers or "ignore embedded instructions" warnings for the untrusted content being processed.
Capability inventory: Across its scripts and instructions, the skill utilizes Bash, Write, Read, Edit, and Agent tools, enabling it to execute commands and modify the file system based on its analysis.
Sanitization: There is no evidence of sanitization or escaping of the ingested code/diff content before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several local Python scripts and CLI utilities to perform its tasks. These scripts are not part of the skill's file bundle, making their specific logic unverifiable in this context.
Evidence: Execution of python3 scripts/validate-review-output.py, python3 ~/.claude/scripts/score-component.py, and python3 scripts/disprove-findings.py. It also utilizes the GitHub CLI (gh pr view) to fetch metadata.

review