The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to define the intent of a review, which is then inserted into the prompt template for reviewer subagents.
Ingestion points: User messages, commit messages, and PR descriptions are gathered in SKILL.md (Step 2) to establish the "Intent".
Boundary markers: The {INTENT} placeholder in REVIEWER-PROMPT.md is wrapped in a markdown blockquote (>), which is a weak delimiter that can be easily bypassed by adversarial text to hijack the subagent's instructions.
Capability inventory: The skill uses a subagent tool to invoke other models and performs git diff operations via shell commands.
Sanitization: There is no evidence of sanitization or escaping of the user-provided intent string before it is interpolated into the prompt template.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to identify code changes.
Evidence: SKILL.md Step 1 explicitly directs the agent to run git diff $(git merge-base HEAD origin/HEAD) to gather the changeset for review.
[DATA_EXFILTRATION]: The skill accesses local configuration files to determine which models to use for the review process.
Evidence: SKILL.md Step 3 reads ~/.config/ox/models.md to parse the panel configuration. While this is functional for the skill's purpose, accessing files in the user's home directory is a sensitive operation.

interrogate