The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from code diffs and pull request descriptions without explicit boundary markers or sanitization logic in the sub-agent prompts.
Ingestion points: Data enters the agent context through gh pr diff, git diff, and the Read tool (used for project configuration and source files).
Boundary markers: The prompts defined for the parallel reviewers (Security, Performance, etc.) do not include delimiters or instructions to ignore embedded commands within the code being reviewed.
Capability inventory: The agent has access to Bash, Task (agent spawning), and Write tools, which could be exploited if an injection attack succeeds.
Sanitization: No evidence of input validation or escaping of the code content before it is passed to the sub-agent prompts.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute system commands such as gh pr diff and git diff. While these are necessary for the skill's functionality, they represent a standard command execution surface.

engineer-review