The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could potentially contain malicious instructions if the git environment or user arguments are manipulated.
Ingestion points: The skill retrieves the current git branch name via git branch --show-current and accepts user-provided text through the $ARGUMENTS variable.
Boundary markers: There are no explicit delimiters or warnings to the agent to ignore instructions embedded within the branch name or user arguments.
Capability inventory: The skill has file system access (Write, Edit, Glob) and limited shell execution capabilities (Bash) which could be targeted by an injection attack.
Sanitization: The skill does not perform escaping or validation on the branch name or $ARGUMENTS before writing them to the journal file.
[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic markers to execute shell commands automatically when the skill is loaded.
Evidence: Found !git branch --show-current and !date '+%F %H:%M' in the Context section of SKILL.md.
Analysis: These commands are used to pull metadata into the agent's context. In this instance, the commands are benign and purpose-built for the journal's functionality.
[COMMAND_EXECUTION]: The skill frontmatter explicitly restricts shell execution to specific, low-risk commands.
Evidence: allowed-tools includes Bash(date *), Bash(git branch *), and Bash(mkdir *).
Analysis: This demonstrates a principle of least privilege by scoping the Bash tool to only the specific commands required for journal creation and time-stamping.

dev-journal