The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains an indirect prompt injection surface within its automation hooks, which ingest untrusted content from the project being reviewed.
Ingestion points: session-start.sh reads project manifest files (e.g., package.json, requirements.txt) and dependency audit logs. post-edit-quickscan.sh reads source code snippets from any file modified by the user.
Boundary markers: Injected findings are delimited by markdown headers (e.g., ## SECURITY QUICK-SCAN), though the agent is not explicitly instructed to ignore potentially malicious commands within those blocks.
Capability inventory: The agent has access to several powerful tools including Bash for command execution, Read for file access, and Edit for file modification.
Sanitization: The hooks use JSON encoding for data safety during transmission, but no semantic sanitization is performed on the ingested code or metadata to neutralize potential injection instructions.

security-reviewer