The Agent Skills Directory

[DATA_EXFILTRATION]: The documentation in REFERENCE.md (lines 235-277) demonstrates a 'Parallel Information Gathering' pattern that redirects command output to predictable file paths in the /tmp/ directory (e.g., /tmp/git_status.txt, /tmp/git_diff_staged.txt). Using hardcoded paths in a shared global directory allows any local user to read the contents of the generated logs and facilitates symlink attacks where a malicious user could cause the skill to overwrite sensitive files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the git repository (via git log and git diff), including commit messages and code changes, and presents it to the agent. This creates an indirect prompt injection surface where a malicious repository contributor could embed instructions to manipulate the agent's behavior.
Ingestion points: scripts/get_commit_history.sh (git log) and scripts/get_branch_diff.sh (git diff).
Boundary markers: None present to distinguish repository metadata from agent instructions.
Capability inventory: The skill performs file system reads and outputs data to the terminal context.
Sanitization: The skill does not sanitize or escape the content of commit messages or diffs before displaying them.

git-analysis