The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various git commands and shell pipelines (using sed, awk, grep, sort, uniq) to identify the repository's base branch, compare code changes, and detect 'hotspot' files with high modification counts. These operations are local to the repository environment and are essential for providing an informed architectural review.
[DATA_EXFILTRATION]: The skill includes a git remote show origin command, which involves a network handshake with the configured git remote (typically a trusted source like GitHub). There are no patterns suggesting the exfiltration of sensitive credentials or local files to unauthorized external endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external stories, specifications, and repository source files.
Ingestion points: Untrusted content enters via user-provided Jira-style stories and the content of changed files in the repository.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested data.
Capability inventory: The agent has the ability to read files and execute local shell/git commands, but lacks general network write or file system modification permissions in this context.
Sanitization: No specific sanitization or filtering of the input text is performed before analysis.
Context: While the attack surface exists, the risk is minimal as the agent's output is restricted to providing a structured text-based review, and the primary capability (git analysis) is used only for read-only metadata extraction.
[PROMPT_INJECTION]: No evidence of malicious prompt injection, instruction overrides, or safety filter bypass attempts were found. The instructions reinforce a professional architectural persona.

arch-review