The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (branch diffs and repository files) as part of its primary function. While this is necessary for code review, it creates a potential surface for indirect prompt injection if the code being reviewed contains adversarial instructions designed to influence the agent's behavior.
Ingestion points: The skill uses the Read and Bash tools in SKILL.md (Step 1) to ingest git diffs and file contents.
Boundary markers: The instructions lack explicit boundary markers or delimiters to separate untrusted code content from the agent's own instructional context.
Capability inventory: The skill has access to Bash, Read, Glob, and Grep, providing a significant capability surface for command execution and file system access.
Sanitization: There are no explicit instructions for sanitizing or escaping the content read from files before the agent processes it.
[SAFE]: The skill's configuration and instructions promote security best practices for automated auditing. The use of context: fork provides execution isolation, and the 'Guardrails' section explicitly forbids code modifications and the invention of findings. No evidence of malicious intent, obfuscation, or data exfiltration was found.

find-bugs