The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read stack metadata from a local database file (av/av.db) and use that information to drive CLI commands. This creates a potential surface for indirect prompt injection if the database contains maliciously crafted branch names or PR metadata.
Ingestion points: The agent is directed to use the cat command to read the .git/av/av.db file to understand the repository's stack structure (SKILL.md).
Boundary markers: There are no instructions for using delimiters or boundary markers when processing the retrieved JSON data to prevent the agent from misinterpreting embedded strings.
Capability inventory: The skill utilizes av and git CLI tools to perform branch operations, create commits, and interact with GitHub APIs for pull request management (SKILL.md, reference.md).
Sanitization: No specific data validation or sanitization steps are provided for the information extracted from the database file before it is interpolated into shell commands.

av-cli