The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines patterns for the agent to execute shell commands that process filesystem entries. Specifically, in Category C6 (Orphan doc-assets), the instruction uses grep -rl "$(basename <asset>)". If an attacker places a file in the repository with a name containing shell metacharacters or command substitutions (e.g., backticks or $(...)), the agent might inadvertently execute arbitrary code when evaluating the basename expression within a shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where untrusted data (filenames and directory names) is ingested and used to drive agent actions and command construction.
Ingestion points: Filenames and paths retrieved from the workspace via git ls-files and ls commands as described in SKILL.md sections C1, C2, and C6.
Boundary markers: The instructions do not define boundary markers or delimiters to protect the shell commands from malicious filenames.
Capability inventory: The skill uses grep, ls, git rm, and git check-ignore, providing the agent with file read, deletion, and shell execution capabilities.
Sanitization: There is no mention of sanitizing or escaping filenames before they are interpolated into the shell command strings, particularly for the documentation asset checks.

repo-hygiene