The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (git ls-remote and git subtree add) using arguments provided directly by the user (<url>, <name>, <branch>). This creates a risk of command injection if the inputs are not strictly validated or escaped before being passed to the shell.
[PROMPT_INJECTION]: The skill facilitates Indirect Prompt Injection by design. It automates the process of importing untrusted third-party source code into the agent's active context to be used as 'Reference material'.
Ingestion points: SKILL.md (Steps 2 and 3) defines the process for pulling remote content via Git.
Boundary markers: The skill adds a '## Reference repositories' header to AGENTS.md, but does not provide explicit instructions for the agent to ignore or sanitize instructions found within the imported source code.
Capability inventory: The agent possesses Bash, Read, Write, and Edit capabilities, which could be abused if the imported code contains malicious instructions that the agent follows.
Sanitization: There is no mechanism described to sanitize, scan, or validate the content of the external repository before it is integrated into the workspace.

clone-repo