The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the repository (git diffs, commit logs, issue tracker data, and documentation files) and passes it to sub-agents for analysis. A malicious actor could embed instructions in code comments or issue descriptions to manipulate the sub-agents' behavior. 1. Ingestion points: The skill reads output from git diff, git log, and various documentation files (CLAUDE.md, CONTRIBUTING.md, spec files under docs/ or specs/). 2. Boundary markers: The instructions do not define explicit delimiters or instructions for the sub-agents to ignore embedded commands within the provided content. 3. Capability inventory: The skill has the capability to spawn sub-agents and read repository files. 4. Sanitization: No sanitization or filtering is applied to the ingested content before it is processed by the sub-agents.
[COMMAND_EXECUTION]: The skill executes git diff and git log commands to analyze changes. These commands use arguments provided by the user (fixed points like commit SHAs or branch names), which is standard behavior for a review tool but involves direct interaction with the local shell environment.

review