The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill is vulnerable to indirect prompt injection because it interpolates untrusted git diff content directly into the LLM prompt in scripts/run_review.py. An attacker could include instructions in a code comment (e.g., 'REVIEW_PASSED') to bypass the security review.
- Ingestion points: scripts/run_review.py via get_git_diff() function which reads untrusted diff data.
- Boundary markers: Uses weak triple-backtick delimiters (```) which are easily escaped within code content.
- Capability inventory: The skill influences the success or failure of a git commit (blocking capability) and outputs results to the console.
- Sanitization: No sanitization or escaping of the diff content was detected before interpolation.
[Persistence] (MEDIUM): The scripts/install_hook.py script modifies the project's .git/hooks directory to install pre-commit or pre-push hooks. This ensures the tool runs automatically during the git lifecycle, which is a persistence mechanism within the development environment.
[Command Execution] (LOW): The scripts scripts/run_review.py and scripts/load_rules.py execute external commands like git and the claude CLI via subprocess.run. While necessary for functionality, this relies on the integrity of the local environment's PATH.
[External Downloads] (INFO): The skill references and requires the anthropic Python package and the @anthropic-ai/claude-cli Node.js package. These are categorized as LOW/INFO because they originate from a Trusted Source (Anthropic) per the [TRUST-SCOPE-RULE].

ai-code-reviewer