The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which can contain malicious instructions designed to influence the agent's behavior during the review process.
Ingestion points: The agent reads external code diffs via git diff (Gate 1 and 4) and ingests requirement specifications from files in docs/, specs/, or issue trackers (Gate 2).
Boundary markers: The skill uses specific HTML comment markers (e.g., , ) to structure its output, which helps delineate agent-generated content from data, though these can be targeted by sophisticated injections.
Capability inventory: The agent has the capability to execute shell commands (git), read arbitrary project files, and write review artifacts (CODE-REVIEW.md) to the filesystem.
Sanitization: The skill contains explicit instructions to redact secrets, tokens, and personal data (Gate 5) and uses a local Python script (validate_review.py) to enforce the integrity of the generated report.
[COMMAND_EXECUTION]: The skill executes shell commands based on user-provided input, creating a surface for command injection.
Evidence: In Gate 1, the skill takes a user-supplied <base> reference and uses it directly in commands such as git rev-parse --verify <base> and git diff <base>...HEAD. If the platform or agent does not properly sanitize these inputs before shell execution, an attacker could potentially execute arbitrary commands by supplying a malicious branch or commit name.
Mitigation: The skill attempts to mitigate this by instructing the agent to validate the reference with git rev-parse before proceeding.

code-review