The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process code diffs and file contents from the user's local repository. This creates an attack surface where malicious instructions could be embedded in code comments (Indirect Prompt Injection). However, the skill implements strong mitigations by enforcing a read-only state for sub-agents.
Ingestion points: SKILL.md Step 1 identifies diffs and files to be reviewed by the agent.
Boundary markers: The prompt template in references/reviewer-prompt.md uses Markdown headers and blockquotes to separate the untrusted code content from the reviewer instructions.
Capability inventory: The reviewer sub-agents are explicitly configured with readonly: true in SKILL.md Step 3, which prevents them from executing shell commands or writing to the file system.
Sanitization: The skill does not explicitly sanitize the incoming code content, relying instead on the sub-agent's configuration and the lead reviewer's synthesis to filter out noise or malicious suggestions.

interrogate