The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and review external data such as files, diffs, and pull requests, which creates an attack surface for instructions embedded in that data.
Ingestion points: Rules in SKILL.md and references/workflow.md instruct the agent to read and judge external code and project documentation.
Boundary markers: There are no instructions to use delimiters or specific warnings to ignore embedded directives within the reviewed content.
Capability inventory: The agent is authorized by references/data-and-trust.md and references/workflow.md to execute various shell commands, including starting local development services (pnpm, Docker, Metro) and running formatting/linting scripts.
Sanitization: The skill lacks requirements for sanitizing or escaping the content of reviewed files before they are processed.

chase-review