The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands (codex exec and claude -p) using a prompt that includes untrusted content ('The code or diff to review'). If the agent replaces the placeholder with a string containing shell metacharacters (such as ;, |, or backticks) from a malicious diff, it could result in arbitrary command execution on the host environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as detailed below:
Ingestion points: Reads untrusted data from recent diffs, user messages, and local files like brain/principles.md and references/reviewer-lenses.md (as specified in SKILL.md).
Boundary markers: Absent. The prompt template provided in SKILL.md does not include delimiters or instructions for the reviewers to ignore embedded directives within the code or diffs being reviewed.
Capability inventory: The skill has the capability to execute shell commands and write files to temporary directories (SKILL.md).
Sanitization: Absent. There are no instructions or mechanisms mentioned for sanitizing, escaping, or validating the input data before it is interpolated into prompts or executed via CLI tools.

adversarial-review