The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external targets (code, skills, artifacts) which may contain malicious instructions. The instructions explicitly mitigate this risk by defining a 'reviewer-only' boundary where findings are treated as evidence rather than execution instructions, and by strictly prohibiting the reviewer from editing code or advancing workflow states independently.
Ingestion points: Ingests external artifacts via [target-path] and review instructions via <issue-description> as defined in SKILL.md.
Boundary markers: Uses a structured markdown report format with a required YAML frontmatter to separate metadata from findings.
Capability inventory: Limited to reading local target files and writing a single markdown report. No network access, subprocess execution, or directory creation capabilities are granted to the reviewer.
Sanitization: Instructions require the agent to mark uncertain findings as such and to keep observations separate from proposed fix directions to prevent automated obedience to embedded suggestions.
[SAFE]: The skill enforces a strict path resolution contract, requiring all relative paths to resolve against the active project root and explicitly forbidding access to system-level directories such as /tmp or the user's home directory.
[SAFE]: The protocol follows least-privilege principles by delegating directory creation and orchestration to an upstream coordinator, preventing the agent from performing unauthorized filesystem modifications or silent file overwrites.

multi-cli-review