The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from the local repository and external arguments.
Ingestion points: Untrusted data enters the agent context through implementationFiles (source code, configuration, and scripts identified via git diffs) in Step 1, and via the Design Doc provided in $ARGUMENTS.
Boundary markers: The prompts used to invoke sub-agents, such as code-reviewer in Step 2 and security-reviewer in Step 3, interpolate the contents of these untrusted files directly into the prompt string without the use of protective delimiters or instructions to ignore embedded commands.
Capability inventory: The orchestrator invokes agents with the ability to modify the filesystem, specifically task-executor for implementation fixes and technical-designer for documentation updates, creating a risk that injected instructions could lead to malicious code modifications.
Sanitization: The skill lacks sanitization or validation mechanisms for the repository content it processes, relying on the model to distinguish between code to be reviewed and potential instructions embedded within that code.

recipe-review