The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs a subagent to process and evaluate arbitrary git diffs which may contain attacker-controlled content in the form of code comments, string literals, or documentation.
Ingestion points: The code-reviewer.md template directs a subagent to execute git diff on a specified range and ingest the output for evaluation.
Boundary markers: Absent. The diff content is not wrapped in specific delimiters or preceded by instructions for the LLM to ignore embedded commands within the code being reviewed.
Capability inventory: The subagent has access to repository history and file inspection tools (git diff, git show, git log, git worktree).
Sanitization: No sanitization or filtering is performed on the code content before it is passed to the subagent, relying solely on the subagent's prompt constraints to avoid following instructions within the reviewed code.
[DYNAMIC_EXECUTION]: The skill uses templates to dynamically generate shell commands and instructions for a subagent at runtime.
Evidence: The code-reviewer.md file defines a template that interpolates user-supplied commit SHAs ([BASE_SHA] and [HEAD_SHA]) into bash commands like git diff for execution by the subagent.

requesting-code-review