The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external code and diffs, which serves as an ingestion point for untrusted data that is then interpolated into prompts for other models.
Ingestion points: As detailed in SKILL.md (Step 1), the skill gathers context from user messages, PR descriptions, and the output of git diff commands.
Boundary markers: The template in references/reviewer-prompt.md uses markdown headers and blockquotes to separate the code from instructions, but lacks explicit warning text for the subagents to disregard instructions found within the code blocks.
Capability inventory: The risk of injection is significantly mitigated by the instructions in SKILL.md (Step 3) to spawn all subagents with readonly: true, which limits their environment to read-only operations and prevents them from making changes to the host system.
Sanitization: The skill does not perform automated sanitization of the input code/diff content before it is processed by the subagents.
[COMMAND_EXECUTION]: The skill utilizes local shell commands to retrieve technical context for its review process.
Evidence: SKILL.md instructs the agent to execute git diff main...HEAD to capture changes on a feature branch. This is a standard and necessary operation for a code review tool.
[DATA_EXPOSURE]: The skill reads from a configuration file located in the user's home directory to determine its operating parameters.
Evidence: SKILL.md directs the agent to read ~/.claude/engineering-models.md to identify the specific list of models to be used for the review. This access is limited to the tool's own configuration needs.

interrogate