The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted markdown documents (.md files) from the repository, which are then passed to an LLM for review. This creates a vulnerability where malicious instructions embedded in the documents could potentially influence the reviewer's verdict or behavior.
Ingestion points: The workflow in SKILL.md (Step 1) identifies all changed markdown files to be used as the target set for review.
Boundary markers: The prompt instructions in references/codex-prompt-doc.md do not utilize explicit delimiters or instructions to ignore nested prompts within the reviewed content.
Capability inventory: The skill uses Bash(node:*) and Task to execute local scripts and dispatch review tasks, providing a path for influence if the LLM is compromised by injection.
Sanitization: While the skill uses scripts/validate-family-sentinel.js to ensure the integrity of the review report, it lacks pre-processing sanitization for the input documents.
[DYNAMIC_EXECUTION]: The skill relies on executing local Node.js scripts (scripts/check-doc-links.js, scripts/resolve-review-profile.js, scripts/review-state.js) to manage the review lifecycle and state. This represents a standard use of dynamic execution for skill orchestration within the environment.

doc-review