The Agent Skills Directory

Indirect Prompt Injection (LOW): The skill is highly susceptible to indirect prompt injection because its core function is to process and analyze untrusted data (source code changes).
Ingestion points: The agent reads external data via git diff HEAD~1 and git diff --name-only.
Boundary markers: Absent. There are no instructions to the agent to treat the diff content as data only or to ignore embedded instructions within code comments or strings.
Capability inventory: The skill can execute shell commands (git, grep, gh, codex-subagent), which provides a significant impact surface if the agent is manipulated.
Sanitization: Absent. The data from the diff is processed directly by the LLM without escaping or validation.
Command Execution (SAFE): The skill executes several shell commands to facilitate the review process.
Evidence: Uses git for diffing, grep for pattern matching, and the GitHub CLI (gh issue comment) to post results.
Context: These operations are aligned with the skill's primary purpose of code review and repository management, presenting a standard functional risk rather than a malicious one.

comprehensive-review