The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted code from files, directories, commits, and pull request patches (identified in SKILL.md). This establishes an attack surface where instructions embedded within the reviewed code (e.g., in comments or documentation) could attempt to manipulate the agent's behavior during the review process.
Evidence Chain:
Ingestion points: SKILL.md workflow Step 1 identifies targets such as files, modules, branches, commits, and PR patches.
Boundary markers: The instructions do not explicitly include delimiters or 'ignore embedded instructions' warnings for the content being reviewed.
Capability inventory: The skill allows the agent to 'apply obvious safe Bucket I fixes by default' (SKILL.md), which involves writing to the filesystem via the agent's internal tools.
Sanitization: No sanitization or filtering of external code content is mentioned before it is processed by the lenses.
[COMMAND_EXECUTION]: The skill instructs the agent to autonomously modify files when 'safe fixes' are identified (SKILL.md, lenses/implementation-review.md). While contextually appropriate for a code review tool, this capability increases the impact of a potential prompt injection, as an attacker could theoretically influence the agent to write malicious content or delete code under the guise of a 'fix'.

code-review