The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the project's git history, including commit messages, file diffs, and full file contents, and interpolates this data into the instructions for multiple sub-agents (Ultrabrain and Oracle).
Ingestion points: Output from git log and git diff is captured in variables and passed directly into the prompt field of task() calls in SKILL.md.
Boundary markers: While the prompts use XML-style tags (e.g., <diff>, <commits>) to structure the data, these do not provide a hard security boundary against malicious instructions embedded in code comments or commit messages.
Capability inventory: The skill possesses the ability to execute shell commands and spawn sub-agents, though it does not appear to have automated write or publishing capabilities.
Sanitization: There is no evidence of sanitization or instruction-filtering performed on the diff content before it is processed by the agents.
[COMMAND_EXECUTION]: The skill executes various local shell commands to gather metadata required for the review process.
Evidence: The script runs npm view, git log, git diff, wc, and tr to extract version information and change statistics.
[DYNAMIC_EXECUTION]: The skill uses a dynamic Node.js command to parse the project's configuration file.
Evidence: The command node -p "require('./package.json').version" is used to programmatically retrieve the local version string.

pre-publish-review