The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides shell command templates in Stage 1 and Stage 2 that interpolate user-supplied inputs, such as the author pattern and GitHub login, directly into bash commands (e.g., scripts/select-corpus.sh -a "<author-pattern>" and gh pr list --reviewer "@<login>"). This pattern is vulnerable to command injection if the inputs contain shell metacharacters like semicolons or pipe symbols. Additionally, the skill performs filesystem operations in Stage 4 using git checkout, which changes the environment state based on repository data.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and interpret untrusted data from external sources, specifically git commit history, source code, and pull request comments. Malicious content within the targeted repository could attempt to override the agent's instructions during the style extraction or validation phases.
Ingestion points: Repository source files (via owned-files.txt), git log/blame output, and GitHub PR comments retrieved through the gh CLI.
Boundary markers: No explicit delimiters or instructions are used to separate untrusted repository content from the agent's primary instructions.
Capability inventory: The skill has access to shell execution (bash), filesystem modification (git checkout), and network interaction via the GitHub CLI.
Sanitization: There is no evidence of filtering or sanitization performed on the repository data before it is processed by the agent.

mimic