The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automatically identifies and executes shell scripts found within the repository's tools/ or scripts/ directories and runs commands defined in the package.json file without prior verification of their content.
[DYNAMIC_EXECUTION]: During the "Rehearsal" step (Step 5), the agent is instructed to follow instructions found in the repository's README.md file, including installation and execution steps, which allows for the execution of dynamically interpreted commands from untrusted local content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted repository data, such as file diffs and documentation, which could contain malicious instructions designed to manipulate the behavior of the main agent or the subagent reviewer.
Ingestion points: Repository diffs (Step 4) and README.md content (Step 5).
Boundary markers: No specific boundary markers or warnings are used in the subagent prompts to distinguish between data and instructions.
Capability inventory: Includes shell command execution, file system access (cloning and deletion), and network operations via git push.
Sanitization: The skill does not perform sanitization or validation of the repository's documentation-based commands before execution.

push-check