The Agent Skills Directory

[COMMAND_EXECUTION]: The template in code-reviewer.md interpolates the {BASE_SHA} and {HEAD_SHA} placeholders directly into shell commands: git diff --stat {BASE_SHA}..{HEAD_SHA}. If these variables are populated with malicious strings (e.g., containing semicolons or pipes) rather than valid git SHAs, it could lead to arbitrary command execution in the shell environment.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as the subagent processes untrusted data.
Ingestion points: The subagent reads content from the file system via git diff and implementation descriptions provided in the WHAT_WAS_IMPLEMENTED and PLAN_OR_REQUIREMENTS placeholders.
Boundary markers: The template does not utilize clear delimiters or instructions to the subagent to ignore potentially malicious instructions embedded within the code changes or plan descriptions.
Capability inventory: The agent has the capability to execute shell commands (git) and potentially other tools depending on the environment's configuration.
Sanitization: No validation or sanitization is performed on the code content or the placeholder values before they are interpolated into the subagent's instructions.

requesting-code-review