The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository which could contain malicious instructions designed to influence the agent or sub-agents.
Ingestion points: The skill reads content from git diff output, commit messages, issue trackers, and specification files located in directories like docs/, specs/, or .scratch/.
Boundary markers: The sub-agent prompts interpolate untrusted data (e.g., "the path or fetched contents of the spec") without utilizing clear delimiters or "ignore instructions" headers to isolate it from the agent's instructions.
Capability inventory: The agent executes shell commands via git and spawns general-purpose sub-agents to process the data.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the repository before it is passed to the sub-agents.
[COMMAND_EXECUTION]: The skill performs multiple shell operations to analyze the repository state.
Evidence: The skill utilizes git diff, git status, git log, git rev-parse, and git ls-files to gather information for the review process.
Validation: The skill includes a validation step using git rev-parse <fixed-point> to ensure user-supplied references are valid before proceeding with more complex operations.

code-review