The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from git diffs without implementing boundary markers or sanitization to prevent the agent from obeying instructions embedded in the code comments or strings.
Ingestion points: The workflow reads content directly from the local environment via git diff HEAD and git diff --cached.
Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore any natural language instructions found within the diff output.
Capability inventory: The skill has the capability to run shell commands (git, mkdir) and write files to the local filesystem (/tmp).
Sanitization: There is no evidence of filtering, escaping, or validation of the diff content before it is processed by the agent's reasoning engine.

javascript-review