The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses git and gh (GitHub CLI) to retrieve repository metadata, file lists, and code diffs. These operations are restricted to the local environment and the project's configured forge, aligning with the skill's primary purpose of code analysis.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as pull request diffs and external source code, which creates a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through gh pr diff, git diff, and file reading operations (e.g., git ls-files).
Boundary markers: There are no explicit markers or 'ignore' instructions defined for separating the ingested code from the subagent instructions in the provided briefs.
Capability inventory: The skill can execute shell commands (git, gh) and write to the filesystem during the 'Apply' phase.
Sanitization: The skill does not explicitly sanitize or escape the ingested code before analysis.
Mitigation: The risk is significantly mitigated by a mandatory human-in-the-loop checkpoint; the agent is restricted to a read-only analysis phase ('Find' and 'Plan') and cannot apply any changes ('Apply') until the user has reviewed and accepted the proposed fix plan.

crank-deslop