The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 3) direct the agent to execute shell commands using external CLI tools (codex exec and claude -p) while interpolating a generated prompt. This prompt includes untrusted data such as user messages, code diffs, and plans. Because this content is placed inside double quotes in the shell command (e.g., claude -p "prompt"), an attacker could provide input containing shell metacharacters like backticks, semicolons, or escaped double quotes to execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and messages to provide an adversarial review, creating a surface for indirect prompt injection.
Ingestion points: Step 2 of SKILL.md specifies that the review scope is identified from "recent diffs, referenced plans, user message."
Boundary markers: The prompt template in references/reviewer-prompt.md does not include specific delimiters (such as XML tags) or explicit instructions to the external model to ignore embedded commands within the code being reviewed.
Capability inventory: The skill utilizes powerful CLI tools (codex, claude) and has the ability to read and write files in the /tmp/ directory.
Sanitization: There is no requirement or logic described to sanitize, escape, or validate the untrusted code content before it is interpolated into the final prompt sent to the reviewer CLI.

adversarial-review