The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates untrusted data from the repository being reviewed into its analysis context for sub-agents.
Ingestion points: The skill ingests git diff output, git log commit messages, and external specification files (Issues, PRDs, or documentation) found in the repository or retrieved via an issue tracker.
Boundary markers: The skill does not specify the use of delimiters (such as XML tags or clear markdown blocks) or provide explicit instructions to the sub-agents to ignore potential instructions embedded within the diffs or specifications.
Capability inventory: The skill utilizes the Agent tool to spawn general-purpose sub-agents to perform parallel reviews, providing them with the untrusted data.
Sanitization: There is no evidence of sanitization, escaping, or validation of the content within the diffs or specification files before they are interpolated into the sub-agent prompts.

code-review