The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as pull request comments, CI annotations, and reviewer messages which may contain malicious instructions.
Ingestion points: Untrusted data enters the agent's context through review paths or pasted messages during the 'Intake' phase in SKILL.md.
Boundary markers: The 'Security Model' section in SKILL.md explicitly defines an 'Instruction boundary,' instructing the agent to treat external text as claims to be verified rather than instructions to be obeyed.
Capability inventory: The skill can perform file writes to apply fixes (SKILL.md Step 6) and execute shell commands for Git operations and project tests (SKILL.md Step 7 and references/records.md).
Sanitization: The process requires a separate verification of the claim and the remedy (Step 4) and demands finding-level evidence (Step 7) before a resolution is considered proven.
[DYNAMIC_EXECUTION]: The skill executes the 'project's own tests and checks' to prove that a fix is valid (SKILL.md Step 7). This creates a vector where malicious review suggestions could lead to the execution of arbitrary code if the suggested 'fix' involves modifying the test suite or build configuration.
[COMMAND_EXECUTION]: The skill uses several Git commands to anchor the review to a specific code revision, as detailed in references/records.md. While these are generally read-only inspection commands (e.g., git rev-parse, git diff), they involve direct interaction with the host shell.

cr-receive