The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from pull request code diffs and file contents to perform architectural reviews.
Ingestion points: Data enters the context via gh pr diff, gh pr view, and git diff commands in Phase 3.
Boundary markers: The subagent prompt in Phase 5 uses variable interpolation (e.g., {diff}) but lacks explicit instructions to the subagent to ignore or disregard instructions embedded within the provided code changes.
Capability inventory: The skill can execute shell commands via gh and git and launch subagents with the Agent tool.
Sanitization: No sanitization or filtering is performed on the ingested diff or file contents before they are processed by the LLM.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection (Category 11) in the SKILL.md file using the ! prefix. This executes shell commands (echo and cat) at the time the skill is loaded to provide path and version information to the agent.
[COMMAND_EXECUTION]: The skill frequently executes shell commands using the gh (GitHub CLI) and git tools to fetch pull request metadata, diffs, and commit history. While these are standard developer tools, they represent a broad capability for interacting with the local environment and remote repositories.

arch-review