The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of source code files and git diffs during its review workflow. Maliciously crafted code or comments could attempt to influence the agent's review logic or proposed fixes.
Ingestion points: SKILL.md Step 2 (git diffs), Step 5 (full file reads), and Step 5.5 (diff hunks for subagents).
Boundary markers: Absent. The instructions do not define specific delimiters or instructions to ignore embedded commands within the code being reviewed.
Capability inventory: The agent has the ability to write to the filesystem (Edit tool, TodoWrite), execute shell commands (git), and perform network operations if configured in the ship block.
Sanitization: No explicit sanitization or escaping of the reviewed code content is performed before processing.
[COMMAND_EXECUTION]: The skill performs extensive shell operations using git for change detection, branch management, and committing fixes. Furthermore, the CONFIG.md allows for the configuration of arbitrary shell commands in fields such as buildCommand, testCommand, installCommand, and postMergeCommand. These commands are executed as part of the skill's automation workflows.
[DATA_EXFILTRATION]: While the skill primarily operates locally, the configuration schema in CONFIG.md provides an example of a postMergeCommand that uses curl to trigger a remote deployment. This mechanism could be used to exfiltrate project data or environment details to an external server if the configuration files are maliciously modified.

candid-review