The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and possesses shell execution capabilities, creating a surface for indirect prompt injection where malicious code could influence agent behavior.
Ingestion points: The agent configuration in agents/openai.yaml uses read_file, grep, and codebase_search to ingest external project code.
Boundary markers: The system prompt in agents/openai.yaml does not include explicit delimiters or instructions to treat ingested code as data only or to ignore embedded instructions.
Capability inventory: The agent has access to the bash tool as defined in agents/openai.yaml, which provides a mechanism for command execution if an injection occurs.
Sanitization: No sanitization or validation logic is present in scripts/run_ts-reviewer.py or the agent configuration to filter instructions within processed code.

ts-reviewer