The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources including git diffs, commit messages, and specification files.
Ingestion points: Git diff output, commit logs, and local/remote specification files (e.g., PRDs, issues).
Boundary markers: The instructions do not define explicit delimiters or warnings for the sub-agents to ignore instructions embedded within the code diffs or spec files being analyzed.
Capability inventory: The skill executes local git commands (git diff, git log, git rev-parse), reads repository files, and spawns parallel sub-agents via the Agent tool.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the git repository before it is passed to the sub-agents.
[COMMAND_EXECUTION]: The skill incorporates user-supplied input (the 'fixed point' reference) directly into shell-based git commands.
Evidence: Commands such as git rev-parse <fixed-point>, git diff <fixed-point>...HEAD, and git log <fixed-point>..HEAD rely on the literal substitution of a user-provided string. While the skill includes a validation step using rev-parse, this pattern represents a potential surface for command injection depending on the underlying execution environment's shell handling.

review