The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Bash(git:*) and Bash(gh:*) tools in Phase 0 to scope changes. It executes commands like git diff and gh pr diff to retrieve file lists and diff content, which are then used to drive the rest of the pipeline.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it ingests untrusted code from the working tree and pull request diffs. This external content is interpolated into the context of sub-agents (orchestrate-slice, fix-applier) in Phase 4 and 5. Maliciously crafted code or comments in the audited files could attempt to influence the logic of these sub-agents.
Ingestion points: Working tree diffs, PR diffs, and conversation intent (Phase 0, 1, and 3).
Boundary markers: The skill uses a structured 'change-envelope' and requires agents to emit results in specific JSON fences.
Capability inventory: Access to Edit, Write, git/gh bash tools, and the ability to dispatch sub-tasks with arbitrary prompts via the Task tool.
Sanitization: It implements 'sensitivity gating' by checking file paths against references/sensitivity-paths.md and routing security-critical code (auth/crypto) to higher-capacity models (Opus).
[PROMPT_INJECTION]: Phase 1 allows the agent to implement code directly based on 'conversation intent'. A malicious user could provide instructions that lead to the generation of backdoors or unsafe code patterns which the agent then writes to the filesystem using Edit and Write tools.

drive-change