The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is inherently designed to ingest untrusted data from external sources (pull requests and code changes), creating a vulnerability surface where malicious instructions embedded in a diff could influence the agent behavior.
Ingestion points: The 'Context Gathering' phase in SKILL.md instructs the agent to run git diff and git log, and read relevant project documentation, pulling external code directly into the active context.
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore instructions within data' directives when processing the code diffs.
Capability inventory: The skill has access to powerful tools including Bash, WebFetch, and WebSearch (as listed in SKILL.md frontmatter), which could be targeted by an injection attack to perform unauthorized actions.
Sanitization: Absent. The scripts/review_checklist.py script includes a diff preview in its output without escaping or sanitizing the content, though it does truncate the output to 100 lines.
[COMMAND_EXECUTION]: The skill relies on shell command execution to function.
Evidence: SKILL.md provides git commands for the agent to execute in its environment.
Evidence: scripts/review_checklist.py uses subprocess.run() to execute git diff and git log. While it uses a list for arguments (preventing simple shell injection), it represents a functional capability for local system interaction.

code-reviewer