The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository history and external specification files which are then used to build prompts for internal sub-agents. An attacker could embed malicious instructions within a code diff or commit message to manipulate the sub-agent's review output.
Ingestion points: Data enters the context through git diff output, git log (commit messages), and spec files located in docs/, specs/, or .scratch/ (referenced in SKILL.md, steps 1, 2, and 4).
Boundary markers: The instructions for spawning sub-agents in Step 4 do not specify the use of delimiters (like XML tags or markdown blocks) or include warnings for the sub-agents to ignore instructions contained within the analyzed code.
Capability inventory: The skill executes shell commands using the git tool and spawns sub-agent prompts.
Sanitization: There is no mention of sanitizing or escaping the content of the diffs, logs, or spec files before interpolation.
[COMMAND_EXECUTION]: The skill executes git commands (git diff, git log, git rev-parse) based on a user-supplied <fixed-point> parameter. While the skill attempts to validate the reference using rev-parse, passing raw user input to shell commands carries a risk of command injection if the underlying execution environment does not properly handle shell metacharacters.

code-review