The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent is configured to read the full project codebase, which constitutes untrusted data ingestion.
Ingestion points: The agent has full read access to the project directory as specified in agents/openai.yaml.
Boundary markers: There are no explicit instructions or delimiters in the system prompt to separate the code content from agent instructions or to ignore embedded prompts within the files.
Capability inventory: The agent has access to the bash tool for command execution, as well as read_file, grep, and codebase_search tools defined in agents/openai.yaml.
Sanitization: No sanitization, filtering, or escaping mechanisms are implemented for the external code content before it is processed by the model.
[COMMAND_EXECUTION]: The bash tool is provided to the agent in agents/openai.yaml, allowing for the execution of shell commands within the project environment.

unity-reviewer