The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to find and read SKILL.md files from project-specific directories such as .claude/skills/ and .agents/skills/. This creates a vulnerability where a malicious repository could include a crafted SKILL.md file designed to override the agent's instructions or extract data during the review process.
Ingestion points: The agent reads SKILL.md files from .claude/skills/<name>/SKILL.md, .agents/skills/<name>/SKILL.md, and ~/.claude/skills/<name>/SKILL.md. It also recursively reads any files referenced by these SKILL.md files.
Boundary markers: Absent. The instructions do not specify any delimiters or warnings to ignore potentially malicious instructions embedded in the rules.
Capability inventory: The skill uses git diff for change detection, read_file to ingest rules and code, and can delegate tasks to subagents.
Sanitization: Absent. There is no validation or filtering of the content read from the external SKILL.md files.
[COMMAND_EXECUTION]: The skill uses shell commands like git diff HEAD and git diff <base>...HEAD to identify the code changes to be reviewed. While standard for development workflows, this involves executing commands in the local environment based on the current state of the repository.

kstack-skill-review