The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data through the {DESCRIPTION} and {PLAN_OR_REQUIREMENTS} placeholders in the code-reviewer.md template. A malicious requirement document or feature description could contain instructions designed to bypass the reviewer's logic or exfiltrate information via the git commands it is authorized to run.
Ingestion points: code-reviewer.md via the [DESCRIPTION] and [PLAN_OR_REQUIREMENTS] placeholders.
Capability inventory: Execution of git commands (git diff, git show, git log, git worktree) within the subagent's shell.
Boundary markers: The template uses standard Markdown headers to separate sections, but lacks explicit delimiters (like XML tags or triple quotes) and specific instructions to the subagent to ignore embedded commands within the untrusted content.
Sanitization: No sanitization or validation of the input placeholders is specified before they are passed to the subagent.
[COMMAND_EXECUTION]: The subagent is explicitly instructed to execute shell commands (specifically git operations) to perform its review. While these are necessary for the skill's primary purpose, they constitute a capability that could be targeted if a prompt injection attack is successful.

requesting-code-review