The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and act upon untrusted external data.
Ingestion points: In SKILL.md, the 'Review Process' (Steps 2 and 3) requires the agent to read all issue comments and the PR diff using gh issue view and gh pr diff.
Boundary markers: The skill lacks explicit sanitization or delimiters for the text content of issue comments, which are used for 'Requirement Drift Detection'.
Capability inventory: The agent can perform git push --force-with-lease (in merge-conflict-resolution.md), mark issue checkboxes, and post verdict comments that trigger the wrapper to merge code.
Sanitization: There is no evidence of filtering or escaping logic applied to the content of issue comments or PR diffs before they are processed by the agent.
[COMMAND_EXECUTION]: The skill relies on executing several local bash scripts to perform its functions.
Evidence: SKILL.md and references/e2e-verification.md instruct the agent to run scripts/gh-as-user.sh, scripts/post-verdict.sh, scripts/mark-issue-checkbox.sh, and scripts/upload-screenshot.sh.
The E2E_MODE=command (in references/e2e-command-mode.md) allows for the execution of an arbitrary E2E_COMMAND defined in the project's autonomous.conf. While this is controlled via configuration, it represents a significant execution surface.
[DATA_EXFILTRATION]: The skill handles sensitive authentication tokens to interact with code hosting platforms.
Evidence: scripts/upload-screenshot.sh utilizes GH_TOKEN and GITLAB_TOKEN to authenticate API requests for uploading images to the repository. While these are used within the scope of intended repository operations, they are high-value targets if the agent is compromised via injection.

autonomous-review