The Agent Skills Directory

[PROMPT_INJECTION]: The subagent template in code-reviewer.md interpolates external data such as {PLAN_OR_REQUIREMENTS} and {DESCRIPTION} without using boundary markers (e.g., XML tags or clear delimiters) or instructions to ignore embedded commands. This makes the review process susceptible to indirect prompt injection if an attacker-controlled task plan or code comment contains instructions designed to hijack the subagent's logic.
Ingestion points: code-reviewer.md (via placeholders {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, {DESCRIPTION}, {PLAN_REFERENCE}).
Boundary markers: None present to delimit injected data from the reviewer's instructions.
Capability inventory: File system access through git diff and shell command execution.
Sanitization: No escaping or validation of the interpolated content is performed before processing.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (git rev-parse, git log, git diff) using variable parameters like {BASE_SHA} and {HEAD_SHA}. While these are standard for a git-based workflow, they represent a potential command injection surface if the commit references or descriptions are sourced from untrusted input without proper sanitization.

requesting-code-review