The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from external documents, including 'work briefs', 'revised plans', and 'adversarial reviews' (SKILL.md, lines 95-101). This creates a surface for indirect prompt injection where an attacker could embed malicious instructions to influence the agent's behavior during the review process.
Ingestion points: The workflow requires the ingestion of implementation plans and adversarial review outputs that may originate from third parties.
Boundary markers: The skill attempts to mitigate risk by instructing the worker to 'make no implementation changes' and 'return only the structured review' using a predefined markdown template (SKILL.md, lines 106-107).
Capability inventory: The agent is authorized to read repository files, modify the kickoff.yaml configuration file, and spawn new worker sessions.
Sanitization: There is no explicit requirement for the agent to sanitize or escape the external content before it is interpolated into the dedicated worker's context.
[DYNAMIC_EXECUTION]: The skill dynamically configures and spawns new worker agents based on repository configuration and user interaction. The agent is instructed to resolve harnesses, select models, and update the kickoff.yaml file to define worker behavior at runtime (SKILL.md, lines 52-85). While these actions are guided by user prompts, they involve the runtime creation and assembly of agent execution parameters.

simplicity-review