The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from the local codebase, including Git diffs and untracked files, which creates a surface for indirect prompt injection.
Ingestion points: The instructions in SKILL.md direct the agent to execute git diff and read untracked files using git ls-files to include their content in the review.
Boundary markers: The instructions lack explicit delimiters or guidance telling the agent to treat the code content as data rather than potential instructions.
Capability inventory: The skill uses shell-based Git commands to read project state; it does not perform destructive write operations or unusual network activity beyond git fetch.
Sanitization: There is no sanitization or filtering of the content read from the files or diffs before it is processed by the agent.

branch-review