The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a code reviewer, ingesting untrusted code (diffs and file contents) and user-provided intent statements which are then interpolated into subagent prompts. This creates a standard surface for indirect prompt injection where the code being reviewed could attempt to influence the reviewer's output.
Ingestion points: Step 1 in SKILL.md (collecting diffs/files) and the {DIFF_OR_FILES} and {INTENT} placeholders in references/reviewer-prompt.md.
Boundary markers: The skill does not use specific delimiters or structured wrappers (like XML tags) to isolate the untrusted code from the instructions in the reviewer prompt.
Capability inventory: The skill restricts subagents with readonly: true and the lead agent explicitly states "Do NOT auto-apply changes," ensuring a human-in-the-loop workflow.
Sanitization: No sanitization or escaping of the ingested code or intent text is performed before interpolation.
[COMMAND_EXECUTION]: The skill uses local shell commands to gather the necessary context for the review.
Evidence: SKILL.md executes git diff main...HEAD to identify the changes requiring review.
[DATA_EXPOSURE]: The skill reads specific configuration files from the user's home directory to determine model preferences.
Evidence: Step 3 in SKILL.md reads ~/.cursor/rules/pstack-models.mdc and ~/.agents/pstack-models.md for reviewer configuration.

interrogate