The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze external code changes (diffs, pull requests, and library source code). This creates an attack surface where malicious code being reviewed could contain instructions designed to deceive the agent or exploit its capabilities. The skill lacks specific instructions for sanitizing or isolating this external data before the agent processes or executes tests against it.
Ingestion points: Diff content, PR commits, symbols, and library source code identified in Step 1 and Step 3.
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts in the analyzed data are provided.
Capability inventory: The agent is authorized to generate and run scripts/tests (Step 5) and search across the filesystem (Step 3).
Sanitization: No sanitization or validation steps are defined for the external content before interpolation.
[DYNAMIC_EXECUTION]: In Step 5, the skill explicitly instructs the agent to "Write a script or test that runs the real code, run it, and paste what happened." This involves runtime generation and execution of code based on the analyzed environment. While this is the intended purpose of the skill to prove safety facts, the execution of dynamically generated code based on untrusted inputs is a significant capability that requires user oversight.

blast-radius