The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from git diffs and external specifications which are then passed to sub-agents for analysis.
Ingestion points: Untrusted data enters the agent's context through git diff output, git log output, and files retrieved from the issue tracker or directories such as docs/, specs/, or .scratch/ (SKILL.md, Steps 1 and 2).
Boundary markers: The prompts generated for the 'Standards' and 'Spec' sub-agents do not use explicit delimiters or instructions to ignore embedded commands, which could allow malicious code comments or documentation content to influence the sub-agents' behavior (SKILL.md, Step 4).
Capability inventory: The agent utilizes shell access to perform git operations, file reading, and potentially network operations through the issue-tracker workflow.
Sanitization: The instructions do not define any sanitization, filtering, or escaping mechanisms for the content of the diffs or specs before they are interpolated into the sub-agent prompts.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with the git repository.
Evidence: The agent is instructed to run git diff, git log, and git rev-parse using user-supplied arguments to identify changes and commit history (SKILL.md, Step 1).

code-review