The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function involves processing untrusted code files, pull request diffs, and directory structures which could contain malicious instructions designed to influence the agent's behavior. \n- Ingestion points: The skill instructions specify reading uncommitted changes via git diff HEAD, comparing branches, and accessing specific file paths or diffs provided by the user in the SKILL.md scope section. \n- Boundary markers: There are no specific instructions or delimiters defined to separate the code content from the agent's instructions, nor are there warnings to the agent to ignore embedded instructions within the files it reviews. \n- Capability inventory: The agent's capabilities in this context are limited to reading local files and executing git commands for analysis. It does not have permissions to write to the file system, execute the code it is reviewing, or perform network operations to send data externally. \n- Sanitization: The skill does not implement any validation, filtering, or escaping of the ingested code content before it is processed by the agent.

sliced-bread-review