The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands (using node and git) that incorporate user-supplied or environment-derived parameters such as <feature>, <Pn>, and <基点>. The instructions do not describe any sanitization or escaping mechanisms, creating a risk of shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as its primary function is to ingest and analyze untrusted data (code diffs and project documentation) to make security-relevant decisions. Ingestion points: Reads and evaluates diff output, spec.md, Pn.md, ACCEPTANCE.md, and project source files (referenced in SKILL.md sections 4 and 5). Boundary markers: No explicit instructions or delimiters are used to isolate the untrusted content from the agent's core logic. Capability inventory: The skill can execute local scripts, perform Git operations, and trigger automated commits via the git-commit tool (referenced in SKILL.md section 1). Sanitization: No evidence of content sanitization or validation exists for the data processed during the review phase.

review