The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of code diffs, branches, and pull requests, which provides a surface for potential indirect prompt injection attacks where malicious code could attempt to influence the reviewer's behavior.
Ingestion points: The orchestrator is instructed to identify and collect changes from various sources, including pull requests and uncommitted changes, in SKILL.md (Workflow Step 1).
Boundary markers: The skill employs several boundary mechanisms, such as spawning reviewers with turn isolation (fork_turns="none") and keeping routing metadata separate from the content assignment packets to prevent control-plane leaks.
Capability inventory: The skill manages a hierarchy of subagents (compact reviewers, specialists, and validators) with the ability to escalate reasoning effort based on task difficulty.
Sanitization: The instructions include explicit guidelines for subagents to "ignore unrelated concerns" and support every finding with "exact code location and evidence," which helps ensure the model focuses on the code structure rather than embedded natural language instructions.

code-review