The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run a shell command (node .gitnexus/run.cjs analyze) in the terminal when it encounters an 'Index is stale' message. Because this command executes a file within the current working directory (the repository being refactored), it could be leveraged by a malicious repository to execute arbitrary code on the user's system.
[INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection because it processes untrusted source code from repositories.
Ingestion points: The agent ingests data from the local repository through tools such as query, context, and impact (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions that might be embedded in the code comments or strings of the files being processed.
Capability inventory: The agent has the ability to modify the filesystem via the rename tool and execute shell commands as described in the workflow instructions (SKILL.md).
Sanitization: There is no evidence of sanitization or validation of the ingested code content before it is processed by the agent.

gitnexus-refactoring