The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it is designed to ingest and process untrusted data from external sources.
Ingestion points: The agent reads pull request descriptions and source code files using Read, Grep, and Glob tools as defined in the Core Workflow and allowed-tools metadata.
Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or specific tokens) or provide clear guidance for the agent to ignore instructions potentially embedded within the code or PR descriptions being reviewed.
Capability inventory: The skill's capabilities are restricted via frontmatter to Read, Grep, and Glob. It does not have the ability to write files, execute shell commands, or perform network operations, which significantly limits the potential for an injection to cause harm beyond misleading the agent's review output.
Sanitization: No mechanisms for filtering, escaping, or validating the content of the analyzed files are present in the skill instructions.

code-reviewer