The Agent Skills Directory

[SAFE]: The skill instructions and scripts do not exhibit any signs of malicious intent, obfuscation, or unauthorized data access. The configuration is consistent with its stated purpose of Python code review.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because its primary function involves reading and analyzing untrusted code from a project codebase. Malicious instructions embedded in reviewed files could theoretically attempt to influence the agent's behavior. This risk is inherent to the functionality of any automated code review tool.
Ingestion points: The agent uses read_file, grep, and codebase_search to ingest content from the project being analyzed, as configured in agents/openai.yaml.
Boundary markers: The system prompt in agents/openai.yaml does not define specific delimiters or instructions to ignore embedded prompts within the files it reads.
Capability inventory: The agent is equipped with the bash tool and has file system access to read the project and write review artifacts, which could be targeted by an injection attack.
Sanitization: There is no evidence of input validation or sanitization of the codebase content before it is processed by the agent.

python-reviewer