The Agent Skills Directory

[COMMAND_EXECUTION]: The skill incorporates user-supplied input directly into shell commands, specifically git diff <fixed-point>...HEAD and git log <fixed-point>..HEAD. This pattern may be susceptible to argument injection if the input is not strictly validated as a git reference. Although git rev-parse is used as an initial check, it may not prevent all forms of crafted input from affecting the subsequent git commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from several sources, which could contain malicious instructions intended to manipulate the sub-agents during the review process.
Ingestion points: The skill reads commit messages via git log, code changes via git diff, and various files in the repository (docs/, specs/, .scratch/). It also references an external issue tracker workflow to fetch content based on commit metadata.
Boundary markers: The prompts for the sub-agents do not use robust boundary markers or explicit safety instructions to disregard commands embedded in the analyzed code or commit history.
Capability inventory: The skill possesses the capability to read local files and execute git commands. The issue tracker workflow represents an additional vector for external data to enter the agent's context.
Sanitization: The skill lacks explicit logic to sanitize or escape the content of commit messages, code diffs, or spec files before they are included in the sub-agent instructions.

code-review