The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructions the agent to read and process untrusted code changes from the repository, which could contain adversarial instructions.
Ingestion points: Reads code changes and repository guidelines (SKILL.md, AGENTS.md, CLAUDE.md) using git commands and direct file access.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between the skill's instructions and the content of the files being reviewed.
Capability inventory: The skill uses subprocess calls to execute git commands (git status, git diff, git log, git show) and reads files from the local filesystem.
Sanitization: There is no evidence of sanitization, escaping, or validation of the content read from files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various git commands to inspect the state of the repository.
Evidence: Commands include git status --short, git diff --stat, git diff -- <path>, git log -1 --stat, and git show <commit> in the 'Inspect The Change Set' section.

review-changes