The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes git diff to retrieve code changes for analysis. This is an expected and standard command for a code review tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from source code, diffs, and pull request metadata which could contain malicious instructions.
Ingestion points: Untrusted data enters the context through git diff and file reads in SKILL.md (Step 1).
Boundary markers: The references/reviewer-prompt.md template uses headers and blockquotes to separate the {DIFF_OR_FILES} content, but it does not include explicit instructions to the subagents to ignore instructions embedded within the code.
Capability inventory: The skill can read local files, execute git commands, and spawn multiple subagent reviewers. It lacks file-write or network-out capabilities.
Sanitization: No sanitization or escaping of the diff content is performed before it is interpolated into the reviewer prompts.
Mitigation: The risk is significantly reduced by the platform's 'allow_implicit_invocation: false' policy, the 'Do NOT auto-apply' instruction, and the requirement for a synthesized human-reviewed lead judgment.

cursor-interrogate