The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (git repository history and changes), creating a surface for indirect prompt injection attacks.
Ingestion points: Data from git status, git log, and git diff is interpolated into the agent's prompt in SKILL.md via placeholders like <full diff> and <commit log>.
Boundary markers: Untrusted data is enclosed in markdown code blocks; however, there are no explicit instructions to the agent to disregard instructions or control sequences that might be contained within that data.
Capability inventory: The skill allows the agent to use powerful tools including Bash, PowerShell, and Task, which could be abused if the agent is successfully manipulated by injected instructions in the diff content.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the incoming git data to prevent instructions within the code changes from being interpreted by the AI model as part of its operational logic.

security-review