The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from the repository and subagent outputs.
Ingestion points: File content from the repository (e.g., REVIEW.md, AGENTS.md, CLAUDE.md), the git diff of the changes being reviewed, and the text responses from the tnr-reviewer subagent.
Boundary markers: While the prompt template uses placeholders like <resolved scope>, it lacks explicit instructions to the reviewer subagent to ignore or isolate potentially malicious instructions embedded within the code comments or documentation it is tasked to process.
Capability inventory: The skill has extensive capabilities, including executing shell commands via git and repository build/test suites, writing to the filesystem to implement fixes, and initiating cross-agent communication using the acpx tool.
Sanitization: The instructions do not define any mechanism for sanitizing or escaping content ingested from the repository or the subagent before it is used in subsequent commands or prompts.
[COMMAND_EXECUTION]: The skill is designed to execute arbitrary repository build and test commands, as well as several git operations (git diff, git status, git rev-parse). Although these are intended for legitimate development workflows, they provide a powerful execution surface that could be exploited if the agent is misled by malicious input in the code or review instructions.

thermo-nuclear-review-loop