The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading the output of git show <BASE_SHA> (the diff of a specific commit) and pasting it into the prompt for a thermo-nuclear-code-quality-review subagent. This creates a surface where malicious instructions embedded within the code under review (e.g., in comments or strings) could influence the subagent's behavior.
Ingestion points: SKILL.md instructs the agent to paste the committed diff from git show <BASE_SHA> into a prompt template for a subagent.
Boundary markers: The diff is delimited using markdown code blocks (```diff), but there are no specific instructions telling the subagent to ignore any instructions found within the code content itself.
Capability inventory: While the subagent is marked readonly: true, the primary agent executing this skill has full file system write access and git execution privileges.
Sanitization: There is no evidence of filtering or sanitization of the diff content before it is processed by the subagent.
[COMMAND_EXECUTION]: The skill uses shell command templates that incorporate variables like <branch>, <BASE_SHA>, and <scope>. If these variables are derived from untrusted sources (such as a branch name containing shell metacharacters like ; or &&), it could lead to arbitrary command execution when the agent runs the git worktree add or git commit commands.
Evidence: The workflow uses git worktree add -b review/<branch>-<BASE_SHA:0:7> ../review-<BASE_SHA:0:7> <BASE_SHA> and git commit -m "$(cat <<'EOF' refactor(<scope>): ... EOF )".

nv-park-and-review