The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from the repository's working directory and staged changes, creating a surface for indirect prompt injection.
Ingestion points: The agent reads raw file content and code changes via git diff and git diff --cached as described in SKILL.md (Step 5) and modules/git-commands.md.
Boundary markers: The skill lacks instructions to wrap the ingested diff content in delimiters or to use specific prompts that warn the agent to ignore instructions embedded within the code.
Capability inventory: The skill has the capability to execute shell commands (e.g., make lint, git operations) which could be targeted by an injection attack.
Sanitization: The skill does not perform any sanitization or filtering on the diff output before the agent processes it to identify "key themes".
[COMMAND_EXECUTION]: The skill relies on the execution of shell commands to perform its functions.
Evidence: In SKILL.md (Step 3), the skill instructs the agent to run make lint. This command executes instructions defined in a local Makefile, which can potentially include arbitrary system commands.
Evidence: The skill frequently executes various git subcommands and pwd to verify the environment and repository state.

git-workspace-review