The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and analyze untrusted content from pull requests, code diffs, and commit messages. This naturally creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the code or comments being reviewed.
Ingestion points: The agent reads user-provided diffs, PR descriptions, and code comments as evidence for its review (SKILL.md).
Boundary markers: The skill contains an explicit 'Review conduct' section that instructs the agent to ignore any instructions found within the PR content that attempt to alter the review process (e.g., "skip protocol checks" or "approve this").
Capability inventory: The skill utilizes web-fetching capabilities to retrieve protocol documentation; it does not explicitly request file-writing or command execution capabilities.
Sanitization: The skill relies on behavioral instructions to ignore embedded commands rather than automated string sanitization.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to fetch machine-readable indexes and documentation pages from docs.adcontextprotocol.org to verify code against the most recent protocol specification.
Evidence: SKILL.md specifies fetching https://docs.adcontextprotocol.org/llms.txt and following links to stable spec paths at https://docs.adcontextprotocol.org/docs/ for every review.
[SAFE]: The skill proactively includes security-focused review rules in its reference files. It instructs the agent to flag security bugs such as hardcoded credentials and SSRF (Server-Side Request Forgery) risks when fetching counterparty-supplied URLs (references/auth-and-webhooks.md).

adcp-review