The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data during the code review process.
Ingestion points: Data enters the agent's context through placeholders like {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, and {DESCRIPTION} in both SKILL.md and the code-reviewer.md template, as well as via the output of git diff.
Boundary markers: There are no boundary markers or delimiters used to isolate the untrusted content from the agent's instructions, nor are there specific instructions to ignore embedded commands.
Capability inventory: The agent has the ability to execute shell commands (git) and spawn subagents with 'superpowers' via the Task tool.
Sanitization: No sanitization or validation logic is provided to ensure that external content does not interfere with the agent's core logic.
[COMMAND_EXECUTION]: The code-reviewer.md template performs shell command execution using direct variable interpolation.
Evidence: The template includes git diff --stat {BASE_SHA}..{HEAD_SHA}.
Concern: If the git commit identifiers or related metadata are manipulated to include shell metacharacters, it could lead to command injection when the agent attempts to run the diff command.

requesting-code-review