The Agent Skills Directory

[COMMAND_EXECUTION]: The delegation logic in SKILL.md allows for arbitrary command execution. It takes the first argument from $ARGUMENTS (labeled as Agent) and interpolates it directly into a Bash command string: -q "". Because this input is not validated or sanitized, a malicious user or an automated process could provide a command string (e.g., using shell metacharacters like ;, &&, or |) to execute unauthorized code on the host system.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context injection markers (!) to execute git diff --cached and git log --oneline -10 at load time. While these specific commands are standard for the skill's intended purpose of code review, they represent automated command execution that occurs without user intervention whenever the skill is loaded.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection. (1) Ingestion points: Untrusted data enters the agent context through user-supplied feature descriptions in $ARGUMENTS, as well as staged changes and file content retrieved via the Read, Glob, and Grep tools (SKILL.md). (2) Boundary markers: The instructions do not define clear delimiters or 'ignore instructions' warnings when interpolating this external content into the review prompt. (3) Capability inventory: The skill has access to powerful tools including Bash and the Agent tool. (4) Sanitization: There is no evidence of sanitization, validation, or escaping of the external content before it is processed or delegated.

code-review