The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of Git diffs, repository files, and external web content, which presents a surface for indirect prompt injection.
Ingestion points: The skill reads input revisions, diff content, repository files, and content from external URLs via WebFetch (SKILL.md).
Boundary markers: The skill contains an explicit 'Trust Boundary' section instructing the agent to treat all input as untrusted and to ignore instructions embedded within the data.
Capability inventory: The skill possesses file write capabilities (creating templates in the tmp/ directory), network access via WebFetch, and the ability to invoke the review-exec skill.
Sanitization: The skill implements logic to sanitize branch names for filenames (replacing non-alphanumeric characters) and specifies non-interactive Git operations to prevent command injection through revision strings.

review-planner