The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes potentially untrusted data from the repository being scanned, including code, comments, and pull request metadata. An attacker with the ability to modify these files could attempt to influence the agent's findings or patch suggestions.
Ingestion points: Repository content is read via standard file tools and git commands; pull request titles and descriptions are fetched from GitHub metadata via the gh CLI.
Boundary markers: The skill provides explicit instructions to the agent to treat all repository and subagent content as data to be analyzed, rather than as instructions to be followed.
Capability inventory: The agent has access to file writing, workflow execution, and a specific set of shell commands for repository management.
Sanitization: The skill implements strict shape checks for finding IDs and git reference names to prevent command injection, and uses isolated git configurations to prevent interference from the user's local settings.
Execution of Project Tests: During the patch verification process, the agent is instructed to execute the project's own test suite to ensure the suggested fix does not break existing functionality.
Context: While necessary for verifying fix correctness, executing arbitrary code from a project's test suite poses a security consideration if the repository itself is untrusted. The skill documentation explicitly acknowledges this and recommends running the tool within a sandbox environment for codebases that are not fully trusted by the user.
Dynamic Context Injection: The skill utilizes the !command syntax to dynamically inject the session start time and a list of existing report directories into the prompt at load time.
Evidence: The usage involves benign commands (date and find) restricted to the skill's own report directory structure.
Context: These operations are used for session bookkeeping and do not process user-supplied or untrusted input, which aligns with safe implementation practices for dynamic context.
Command Execution and Environment Control: The skill executes various git and shell commands to manage repository state and run internal analysis scripts.
Safety Mechanism: All git operations are prefixed with environment variables to ensure they run without reading global user configuration or hanging on interactive prompts.
Safety Mechanism: The skill follows a strict protocol of one simple command per Bash call to mitigate the risk of command injection through shell chaining.

claude-security