The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and diff data which could contain malicious instructions designed to hijack the agent's logic.
Ingestion points: The skill uses git diff, Read, and Grep tools to ingest content from the repository files as instructed in SKILL.md.
Boundary markers: The skill lacks explicit markers to delimit untrusted code content from its own instructions.
Capability inventory: The skill has access to Read, Grep, Glob, and Bash (restricted to git commands) as specified in SKILL.md.
Sanitization: No sanitization of the ingested code content is performed.
Mitigation: SKILL.md includes strong behavioral constraints (e.g., "Do not perform the review", "State facts only") which help prevent the agent from executing instructions found in the data.
[COMMAND_EXECUTION]: The skill instructs the agent to construct and execute shell commands using user-provided input.
The instructions in SKILL.md direct the agent to parse $ARGUMENTS and run git diff <base>...HEAD.
This allows potential injection of malicious git flags if the user provides crafted input for the base branch.
Mitigation: The allowed-tools configuration in SKILL.md limits the Bash tool to specific git subcommands, preventing the execution of arbitrary non-git commands.

review-order