The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function involves ingesting and analyzing untrusted source code and configuration files. An attacker could potentially embed instructions within the code being reviewed to mislead the agent's analysis. * Ingestion points: Source code, diffs, configuration files, and environment variable definitions identified during the mapping of the attack surface (Steps 1 and 2). * Boundary markers: The instructions do not define specific delimiters or instructions to treat analyzed code as data rather than instructions. * Capability inventory: The skill uses codebase exploration and file reading capabilities but is restricted to read-only operations and does not modify the filesystem. * Sanitization: The process does not describe mechanisms to sanitize or escape content found within the analyzed files before it is processed by the agent.

security-review