The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script scripts/review_checklist.py and the Bash tool to execute local git commands (git diff, git log). These commands are used to retrieve the changed files and their contents for the review process. The execution uses standard subprocess.run calls with list-based arguments, which prevents shell injection.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) due to its core functionality of processing untrusted code changes.
Ingestion points: The agent ingests data from the output of git diff and git log in SKILL.md (Phase 1) and scripts/review_checklist.py (via get_changed_files, get_commit_messages, and get_diff).
Boundary markers: The instructions in SKILL.md do not include explicit delimiters or instructions for the agent to treat the code content strictly as data, making it possible for the model to follow instructions embedded in code comments or strings.
Capability inventory: The skill is granted powerful capabilities including Bash (shell execution), WebFetch, and WebSearch, which could be exploited if an injection is successful.
Sanitization: No sanitization or filtering is applied to the code content before it is presented to the language model for analysis.

code-reviewer