The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including repository code, diffs, commit messages, and pull request descriptions, which can contain malicious instructions intended to manipulate the agent or the delegated reviewer model.
Ingestion points: The skill reads staged/unstaged changes, branch diffs, pull request metadata, and issue descriptions to establish the review scope (SKILL.md).
Boundary markers: While the delegated task brief includes role instructions ('You are a report-only code reviewer'), it lacks specific delimiters or 'ignore embedded instructions' warnings to isolate untrusted code from the instructions given to the child model.
Capability inventory: The agent possesses capabilities for file system read/write access (for reviewing and fixing findings) and can launch child models via the delegate_task tool.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the ingested external content before it is interpolated into the prompts for the delegated task.
[COMMAND_EXECUTION]: The instructions direct the agent to verify reviewer findings by running non-mutating reproduction commands or tests, which may involve executing code influenced by the findings.
Evidence: 'Confirm it from the source, a test, or a non-mutating reproduction, not from the reviewer's wording' (SKILL.md).

t3-review