The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses a 'blind reviewer subagent' and interpolates untrusted Swift code directly into the subagent's system prompt via the {{TARGET_CONTENT_OR_PATHS}} placeholder in references/reviewer-prompt.md. This creates an Indirect Prompt Injection surface where malicious code in the reviewed repository could override the reviewer's instructions.
Ingestion point: The {{TARGET_CONTENT_OR_PATHS}} slot in references/reviewer-prompt.md contains the untrusted Swift code under review.
Boundary markers: Absent. The prompt template does not use XML tags, unique delimiters, or 'ignore embedded instructions' warnings to isolate the untrusted code from the instructions.
Capability inventory: The skill allows the agent to read repository files, call subagents, and render a 'PASS' or 'FAIL' verdict that might influence merge decisions in a CI/CD pipeline.
Sanitization: Absent. There are no instructions to escape or validate the code content before interpolation.
[COMMAND_EXECUTION]: The 'Review Protocol' in SKILL.md suggests that the agent execute shell commands like git archive <ref> <skill-dir> | tar -x -C "$TMPDIR". This is a command injection risk because the <ref> (a commit hash or branch name) and <skill-dir> parameters are often user-controlled or derived from the external environment without validation.
[DATA_EXFILTRATION]: The skill instructs the agent to perform broad searches of the repository root (searching beyond the diff for declaring modules, write sites, instantiations). If an indirect prompt injection occurs, this capability could be abused to locate and exfiltrate sensitive files such as credentials or configuration files.

adversarial-swift