The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted code data from the local repository using git commands. This creates a surface where malicious instructions could be embedded in code comments or commit messages to influence the reviewer subagent's evaluation.
Ingestion points: Code changes and commit history are accessed via git diff, git show, and git log as defined in code-reviewer.md.
Boundary markers: The prompt template for the subagent provides structure, but does not use explicit delimiters or warnings to ignore instructions within the code content.
Capability inventory: The subagent is restricted to git inspection tools and is explicitly instructed not to mutate the working tree, index, or branch state.
Sanitization: No sanitization is performed on the code content before it is reviewed by the subagent.
[COMMAND_EXECUTION]: The skill executes various shell-based git commands (git rev-parse, git log, git diff, git worktree) to retrieve SHAs and inspect differences between commits. These commands are standard for development workflows and used appropriately within the skill's scope.
[SAFE]: The skill does not perform network exfiltration, access sensitive environment files (like .env or SSH keys), or attempt to establish persistence. The use of git worktree in /tmp is a legitimate practice for non-destructive code analysis.

requesting-code-review