The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to perform git operations. Evidence in SKILL.md includes the use of git rev-parse to determine commit SHAs. Evidence in code-reviewer.md includes a shell block executing git diff --stat {BASE_SHA}..{HEAD_SHA} and git diff {BASE_SHA}..{HEAD_SHA}.
[PROMPT_INJECTION]: The subagent template is susceptible to indirect prompt injection.
Ingestion points: The placeholders {DESCRIPTION}, {PLAN_REFERENCE}, {BASE_SHA}, and {HEAD_SHA} in code-reviewer.md ingest external data.
Boundary markers: No boundary markers (e.g., delimiters like XML tags) or 'ignore' instructions are used around interpolated placeholders.
Capability inventory: The subagent executes git commands and provides analysis.
Sanitization: No sanitization or validation of the input placeholders is evident in the skill files.
[COMMAND_EXECUTION]: Potential for shell command injection through template placeholders. The placeholders {BASE_SHA} and {HEAD_SHA} are interpolated directly into shell commands within code-reviewer.md. If these variables are populated with malicious shell metacharacters (e.g., ;, |, &&), they could be used to execute arbitrary commands beyond the intended git diff.

requesting-code-review