The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to perform local security scans and explicitly requires that the raw output of these scans be pasted into the conversation response. Core Rule 6 and Workflow Step 2 mandate that the agent "paste the actual commands and their raw output (even when empty/clean) into the response." If a secret (such as an API key, token, or private key) is detected by the grep command in the staged diff, this instruction forces the agent to extract that sensitive credential from the local environment and transmit it to the LLM service's context and logs.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the local repository and uses it to generate commands and commit messages without sanitization or boundary markers.
Ingestion points: Workflow Step 1, 2, and 4 read the git diff --staged output, and Step 3 reads the output of git log --oneline -10.
Boundary markers: There are no explicit delimiters or boundary markers (such as XML tags or unique separators) used to wrap the git output when it is interpolated into the agent's working context.
Capability inventory: The skill has the capability to execute shell commands via the Bash tool, including git add, git commit, and git push.
Sanitization: The instructions do not include any steps to escape, filter, or sanitize the content of the diffs or logs before they are used to influence the agent's commit message generation, which could allow an attacker to inject instructions via a file's content or commit history.

git-helper