The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it instructs the agent to process untrusted external data, such as pull request changes and codebase structures.
Ingestion points: The PR review and Git workflow sections in SKILL.md involve reading external code and metadata.
Boundary markers: The provided instructions do not specify the use of delimiters or warnings to ignore embedded instructions in the processed data.
Capability inventory: The skill utilizes Read, Write, and Bash tools, which could be leveraged if an injection is successful.
Sanitization: No explicit content filtering or validation is described in the workflows.
[REMOTE_CODE_EXECUTION]: Instructions in SKILL.md (line 214) demonstrate downloading and executing an installation script from https://claude.ai/install.sh. This reference targets the official domain of a well-known service associated with a trusted organization.
[COMMAND_EXECUTION]: The skill contains various shell command examples for productivity, including Git worktree management, session handling, and Docker orchestration. These are presented as educational content to guide user workflow optimization.
[CREDENTIALS_UNSAFE]: A Docker usage example in SKILL.md (line 225) includes forwarding the ANTHROPIC_API_KEY environment variable to a container. This follows standard development practices for managing secrets through environment variables rather than hardcoded values.

agentic-workflow