The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md explicitly direct the agent to override platform-level safety mechanisms. In the 'Run the quorum' section, it states: 'Where the worker mechanism offers acceptance gates, disable them: the reviewers are the acceptance layer, and a gate can falsely fail valid reviewer output.' This is a deliberate attempt to bypass security and quality filters for sub-agents.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands based on logic found in the reviewed codebase to verify identified issues. The 'Verify' section in SKILL.md directs the agent to 'reproduce [claims] when the claim warrants it.' This grants the agent the ability to execute code derived from untrusted sources in the local workspace.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of generated or discovered logic through its verification steps. While the instructions mention using 'disposable isolation,' the capability to execute commands based on untrusted code path analysis represents a dynamic execution risk.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its core function of ingesting and processing untrusted source code.
Ingestion points: Files in the workspace, diffs, and pull request descriptions are ingested as the review scope in the 'Resolve scope' section of SKILL.md.
Boundary markers: There are no explicit instructions or specific delimiters used to prevent the agent from interpreting and following commands or instructions embedded within the reviewed code files.
Capability inventory: The agent has the authority to execute shell commands to 'reproduce claims' as part of the verification process.
Sanitization: The skill does not mention any sanitization, filtering, or validation of external content before it is passed to the LLM-based sub-agents for analysis.

code-quorum