The Agent Skills Directory

[COMMAND_EXECUTION]: The code-reviewer.md template utilizes shell commands that incorporate variables through string interpolation. Specifically, the commands git diff --stat {BASE_SHA}..{HEAD_SHA} and git diff {BASE_SHA}..{HEAD_SHA} directly embed the {BASE_SHA} and {HEAD_SHA} placeholders into the shell. This pattern presents a command injection risk if these variables are populated with malicious shell metacharacters, potentially allowing arbitrary code execution in the agent's environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted external data that is then processed by a subagent.
Ingestion points: Data from {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, and {DESCRIPTION} is directly interpolated into the subagent's instructions within code-reviewer.md.
Boundary markers: No delimiters or boundary markers are used to isolate the provided requirements or descriptions from the subagent's system instructions, which could allow malicious content in those fields to influence the reviewer's behavior.
Capability inventory: The subagent has the capability to execute shell commands via the git tool and provides an assessment that impacts the developer's decision to merge code.
Sanitization: There is no evidence of input validation or sanitization for the placeholder values before they are integrated into the prompt.

requesting-code-review