The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it aggregates content from independent code reviews, which are treated as untrusted data inputs.
Ingestion points: Reviewer reports are fetched via the bd comments command in aggregator-prompt.md.
Boundary markers: Findings are identified using [CODE-REVIEW-N/N] tags, but the aggregator prompt lacks robust delimiters or sanitization logic to prevent embedded instructions in the reviews from influencing the subagent.
Capability inventory: The aggregation task has the authority to write files to the temp/ directory and execute bash commands via the bd toolset as seen in aggregator-prompt.md.
Sanitization: No evidence of input validation, filtering, or escaping is applied to the reviewer comments before they are processed by the model.
[COMMAND_EXECUTION]: The skill executes bash commands to interact with the task's environment. These executions appear to be legitimate uses of the platform's internal toolset.
Evidence: Calls to bd comments and bd comments add are utilized in aggregator-prompt.md and references/dispatch-code.md to retrieve and persist review data.

multi-review-aggregation