The Agent Skills Directory

[SAFE]: The skill implements an adversarial review workflow where multiple models (subagents) analyze code changes. It incorporates security best practices by setting the subagents to readonly: true, preventing them from making unauthorized changes to the filesystem. Additionally, it reads configuration from ~/.cursor/rules/pstack-models.mdc to identify reviewer models, which is a standard local configuration access.
[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted repository data. [1] Ingestion points: Data enters via git diff output and file contents included in the review prompt. [2] Boundary markers: Simple markdown blockquotes are used in references/reviewer-prompt.md to wrap intent and diffs, providing minimal structural separation. [3] Capability inventory: Subagents are restricted to readonly mode, limiting their ability to modify the environment even if successfully injected. [4] Sanitization: No specific sanitization or filtering logic is applied to the diff contents before they are passed to the reviewer subagents.

ps-interrogate